chore: publish OpenVEX documents

2025-12-12 17:53:13 +01:00
1074 changed files with 12802 additions and 34421 deletions
@@ -7,6 +7,8 @@ runs:
    - name: go install tools
      shell: bash
      run: |
-          go install tool
-          # NOTE: protoc-gen-go cannot be installed with `go get`
          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30
+          go install storj.io/drpc/cmd/protoc-gen-go-drpc@v0.0.34
+          go install golang.org/x/tools/cmd/goimports@v0.31.0
+          go install github.com/mikefarah/yq/v4@v4.44.3
+          go install go.uber.org/mock/mockgen@v0.5.0
@@ -71,7 +71,6 @@ runs:

        if [[ ${RACE_DETECTION} == true ]]; then
          gotestsum --junitfile="gotests.xml" --packages="${TEST_PACKAGES}" -- \
-            -tags=testsmallbatch \
            -race \
            -parallel "${TEST_NUM_PARALLEL_TESTS}" \
            -p "${TEST_NUM_PARALLEL_PACKAGES}"
@@ -35,12 +35,12 @@ jobs:
      tailnet-integration: ${{ steps.filter.outputs.tailnet-integration }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -124,7 +124,7 @@ jobs:
  #   runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
  #   steps:
  #     - name: Checkout
-  #       uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+  #       uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
  #       with:
  #         fetch-depth: 1
  #         # See: https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#commits-made-by-this-action-do-not-trigger-new-workflow-runs
@@ -157,12 +157,12 @@ jobs:
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -181,7 +181,7 @@ jobs:
          echo "LINT_CACHE_DIR=$dir" >> "$GITHUB_ENV"

      - name: golangci-lint cache
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
            ${{ env.LINT_CACHE_DIR }}
@@ -207,22 +207,6 @@ jobs:
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: v3.9.2
-        continue-on-error: true
-        id: setup-helm
-
-      - name: Install helm (fallback)
-        if: steps.setup-helm.outcome == 'failure'
-        # Fallback to Buildkite's apt repository if get.helm.sh is down.
-        # See: https://github.com/coder/internal/issues/1109
-        run: |
-          set -euo pipefail
-          curl -fsSL https://packages.buildkite.com/helm-linux/helm-debian/gpgkey | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null
-          echo "deb [signed-by=/usr/share/keyrings/helm.gpg] https://packages.buildkite.com/helm-linux/helm-debian/any/ any main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
-          sudo apt-get update
-          sudo apt-get install -y helm=3.9.2-1
-
-      - name: Verify helm version
-        run: helm version --short

      - name: make lint
        run: |
@@ -251,12 +235,12 @@ jobs:
    if: ${{ !cancelled() }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -308,12 +292,12 @@ jobs:
    timeout-minutes: 20
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -343,7 +327,7 @@ jobs:
  test-go-pg:
    # make sure to adjust NUM_PARALLEL_PACKAGES and NUM_PARALLEL_TESTS below
    # when changing runner sizes
-    runs-on: ${{ matrix.os == 'ubuntu-latest' && github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || matrix.os && matrix.os == 'macos-latest' && github.repository_owner == 'coder' && 'depot-macos-latest' || matrix.os == 'windows-2022' && github.repository_owner == 'coder' && 'depot-windows-2022-16' || matrix.os }}
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && github.repository_owner == 'coder' && 'depot-ubuntu-22.04-16' || matrix.os && matrix.os == 'macos-latest' && github.repository_owner == 'coder' && 'depot-macos-latest' || matrix.os == 'windows-2022' && github.repository_owner == 'coder' && 'depot-windows-2022-32' || matrix.os }}
    needs: changes
    if: needs.changes.outputs.go == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
    # This timeout must be greater than the timeout set by `go test` in
@@ -360,7 +344,7 @@ jobs:
          - windows-2022
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -386,7 +370,7 @@ jobs:
        uses: coder/setup-ramdisk-action@e1100847ab2d7bcd9d14bcda8f2d1b0f07b36f1b # v0.1.0

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -470,8 +454,8 @@ jobs:
        uses: ./.github/actions/test-go-pg
        with:
          postgres-version: "13"
-          # Our Linux runners have 8 cores.
-          test-parallelism-packages: "8"
+          # Our Linux runners have 16 cores.
+          test-parallelism-packages: "16"
          test-parallelism-tests: "8"
          # By default, run tests with cache for improved speed (possibly at the expense of correctness).
          # On main, run tests without cache for the inverse.
@@ -500,12 +484,8 @@ jobs:
        uses: ./.github/actions/test-go-pg
        with:
          postgres-version: "13"
-          # Our Windows runners have 16 cores.
-          # On Windows Postgres chokes up when we have 16x16=256 tests
-          # running in parallel, and dbtestutil.NewDB starts to take more than
-          # 10s to complete sometimes causing test timeouts. With 16x8=128 tests
-          # Postgres tends not to choke.
-          test-parallelism-packages: "8"
+          # Our Windows runners have 32 cores.
+          test-parallelism-packages: "32"
          test-parallelism-tests: "16"
          # By default, run tests with cache for improved speed (possibly at the expense of correctness).
          # On main, run tests without cache for the inverse.
@@ -516,7 +496,7 @@ jobs:
          embedded-pg-cache: ${{ steps.embedded-pg-cache.outputs.embedded-pg-cache }}

      - name: Upload failed test db dumps
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: failed-test-db-dump-${{matrix.os}}
          path: "**/*.test.sql"
@@ -543,7 +523,7 @@ jobs:
          api-key: ${{ secrets.DATADOG_API_KEY }}

  test-go-pg-17:
-    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
+    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-16' || 'ubuntu-latest' }}
    needs:
      - changes
    if: needs.changes.outputs.go == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
@@ -554,12 +534,12 @@ jobs:
    timeout-minutes: 25
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -589,8 +569,8 @@ jobs:
        uses: ./.github/actions/test-go-pg
        with:
          postgres-version: "17"
-          # Our Linux runners have 8 cores.
-          test-parallelism-packages: "8"
+          # Our Linux runners have 16 cores.
+          test-parallelism-packages: "16"
          test-parallelism-tests: "8"
          # By default, run tests with cache for improved speed (possibly at the expense of correctness).
          # On main, run tests without cache for the inverse.
@@ -610,18 +590,18 @@ jobs:
          api-key: ${{ secrets.DATADOG_API_KEY }}

  test-go-race-pg:
-    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-16' || 'ubuntu-latest' }}
+    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-32' || 'ubuntu-latest' }}
    needs: changes
    if: needs.changes.outputs.go == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
    timeout-minutes: 25
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -651,13 +631,13 @@ jobs:
      # instances where tests appear to hang for multiple seconds, resulting in flaky tests when
      # short timeouts are used.
      # c.f. discussion on https://github.com/coder/coder/pull/15106
-      # Our Linux runners have 16 cores, but we reduce parallelism since race detection adds a lot of overhead.
-      # We aim to have parallelism match CPU count (4*4=16) to avoid making flakes worse.
+      # Our Linux runners have 32 cores, but we reduce parallelism since race detection adds a lot of overhead.
+      # We aim to have parallelism match CPU count (8*4=32) to avoid making flakes worse.
      - name: Run Tests
        uses: ./.github/actions/test-go-pg
        with:
          postgres-version: "17"
-          test-parallelism-packages: "4"
+          test-parallelism-packages: "8"
          test-parallelism-tests: "4"
          race-detection: "true"

@@ -688,12 +668,12 @@ jobs:
    timeout-minutes: 20
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -715,12 +695,12 @@ jobs:
    timeout-minutes: 20
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -748,12 +728,12 @@ jobs:
    name: ${{ matrix.variant.name }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -797,7 +777,7 @@ jobs:

      - name: Upload Playwright Failed Tests
        if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: failed-test-videos${{ matrix.variant.premium && '-premium' || '' }}
          path: ./site/test-results/**/*.webm
@@ -805,7 +785,7 @@ jobs:

      - name: Upload debug log
        if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: coderd-debug-logs${{ matrix.variant.premium && '-premium' || ''  }}
          path: ./site/e2e/test-results/debug.log
@@ -813,7 +793,7 @@ jobs:

      - name: Upload pprof dumps
        if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: debug-pprof-dumps${{ matrix.variant.premium && '-premium' || ''  }}
          path: ./site/test-results/**/debug-pprof-*.txt
@@ -828,12 +808,12 @@ jobs:
    if: needs.changes.outputs.site == 'true' || needs.changes.outputs.ci == 'true'
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          # 👇 Ensures Chromatic can read your full git history
          fetch-depth: 0
@@ -909,12 +889,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          # 0 is required here for version.sh to work.
          fetch-depth: 0
@@ -980,7 +960,7 @@ jobs:
    if: always()
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -1018,7 +998,7 @@ jobs:
    steps:
      # Harden Runner doesn't work on macOS
      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -1079,7 +1059,7 @@ jobs:

      - name: Upload build artifacts
        if: ${{ github.repository_owner == 'coder' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: dylibs
          path: |
@@ -1100,12 +1080,12 @@ jobs:
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -1155,12 +1135,12 @@ jobs:
      IMAGE: ghcr.io/coder/coder-preview:${{ steps.build-docker.outputs.tag }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -1201,7 +1181,7 @@ jobs:

      # Necessary for signing Windows binaries.
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          distribution: "zulu"
          java-version: "11.0"
@@ -1244,7 +1224,7 @@ jobs:
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1

      - name: Download dylibs
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: dylibs
          path: ./build
@@ -1373,7 +1353,7 @@ jobs:
        id: attest_main
        if: github.ref == 'refs/heads/main'
        continue-on-error: true
-        uses: actions/attest@7667f588f2f73a90cea6c7ac70e78266c4f76616 # v3.1.0
+        uses: actions/attest@daf44fb950173508f38bd2406030372c1d1162b1 # v3.0.0
        with:
          subject-name: "ghcr.io/coder/coder-preview:main"
          predicate-type: "https://slsa.dev/provenance/v1"
@@ -1410,7 +1390,7 @@ jobs:
        id: attest_latest
        if: github.ref == 'refs/heads/main'
        continue-on-error: true
-        uses: actions/attest@7667f588f2f73a90cea6c7ac70e78266c4f76616 # v3.1.0
+        uses: actions/attest@daf44fb950173508f38bd2406030372c1d1162b1 # v3.0.0
        with:
          subject-name: "ghcr.io/coder/coder-preview:latest"
          predicate-type: "https://slsa.dev/provenance/v1"
@@ -1447,7 +1427,7 @@ jobs:
        id: attest_version
        if: github.ref == 'refs/heads/main'
        continue-on-error: true
-        uses: actions/attest@7667f588f2f73a90cea6c7ac70e78266c4f76616 # v3.1.0
+        uses: actions/attest@daf44fb950173508f38bd2406030372c1d1162b1 # v3.0.0
        with:
          subject-name: "ghcr.io/coder/coder-preview:${{ steps.build-docker.outputs.tag }}"
          predicate-type: "https://slsa.dev/provenance/v1"
@@ -1511,7 +1491,7 @@ jobs:

      - name: Upload build artifacts
        if: github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: coder
          path: |
@@ -1552,12 +1532,12 @@ jobs:
    if: needs.changes.outputs.db == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -215,7 +215,7 @@ jobs:
          } >> "${GITHUB_OUTPUT}"

      - name: Checkout create-task-action
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          path: ./.github/actions/create-task-action
@@ -249,7 +249,7 @@ jobs:
          } >> "${GITHUB_OUTPUT}"

      - name: Checkout create-task-action
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          path: ./.github/actions/create-task-action
@@ -23,7 +23,7 @@ jobs:
    steps:
      - name: Dependabot metadata
        id: metadata
-        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"

@@ -36,12 +36,12 @@ jobs:
      verdict: ${{ steps.check.outputs.verdict }} # DEPLOY or NOOP
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -65,12 +65,12 @@ jobs:
      packages: write # to retag image as dogfood
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -146,12 +146,12 @@ jobs:
    needs: deploy
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -162,7 +162,7 @@ jobs:
          } >> "${GITHUB_OUTPUT}"

      - name: Checkout create-task-action
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          path: ./.github/actions/create-task-action
@@ -38,12 +38,12 @@ jobs:
    if: github.repository_owner == 'coder'
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

@@ -23,14 +23,14 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

      - name: Setup Node
        uses: ./.github/actions/setup-node

-      - uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v45.0.7
+      - uses: tj-actions/changed-files@abdd2f68ea150cee8f236d4a9fb4e0f2491abf1b # v45.0.7
        id: changed-files
        with:
          files: |
@@ -26,12 +26,12 @@ jobs:
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-4' || 'ubuntu-latest' }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

@@ -42,7 +42,7 @@ jobs:
          # on version 2.29 and above.
          nix_version: "2.28.5"

-      - uses: nix-community/cache-nix-action@b426b118b6dc86d6952988d396aa7c6b09776d08 # v7.0.0
+      - uses: nix-community/cache-nix-action@135667ec418502fa5a3598af6fb9eb733888ce6a # v6.1.3
        with:
          # restore and save a cache using this key
          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
@@ -78,7 +78,7 @@ jobs:
        uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Login to DockerHub
        if: github.ref == 'refs/heads/main'
@@ -125,12 +125,12 @@ jobs:
      id-token: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

@@ -28,7 +28,7 @@ jobs:
          - windows-2022
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -54,7 +54,7 @@ jobs:
        uses: coder/setup-ramdisk-action@e1100847ab2d7bcd9d14bcda8f2d1b0f07b36f1b # v0.1.0

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -15,9 +15,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Assign author
-        uses: toshimaru/auto-author-assign@4d585cc37690897bd9015942ed6e766aa7cdb97f # v3.0.1
+        uses: toshimaru/auto-author-assign@16f0022cf3d7970c106d8d1105f75a1165edb516 # v2.1.1
@@ -19,7 +19,7 @@ jobs:
      packages: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -39,12 +39,12 @@ jobs:
      PR_OPEN: ${{ steps.check_pr.outputs.pr_open }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

@@ -76,12 +76,12 @@ jobs:
    runs-on: "ubuntu-latest"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -184,7 +184,7 @@ jobs:
      pull-requests: write # needed for commenting on PRs
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -228,12 +228,12 @@ jobs:
      CODER_IMAGE_TAG: ${{ needs.get_info.outputs.CODER_IMAGE_TAG }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -288,7 +288,7 @@ jobs:
      PR_HOSTNAME: "pr${{ needs.get_info.outputs.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -337,7 +337,7 @@ jobs:
          kubectl create namespace "pr${PR_NUMBER}"

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

@@ -14,7 +14,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -65,7 +65,7 @@ jobs:
    steps:
      # Harden Runner doesn't work on macOS.
      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -131,7 +131,7 @@ jobs:
          AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt

      - name: Upload build artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: dylibs
          path: |
@@ -164,12 +164,12 @@ jobs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -253,7 +253,7 @@ jobs:

      # Necessary for signing Windows binaries.
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          distribution: "zulu"
          java-version: "11.0"
@@ -327,7 +327,7 @@ jobs:
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1

      - name: Download dylibs
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: dylibs
          path: ./build
@@ -454,7 +454,7 @@ jobs:
        id: attest_base
        if: ${{ !inputs.dry_run && steps.image-base-tag.outputs.tag != '' }}
        continue-on-error: true
-        uses: actions/attest@7667f588f2f73a90cea6c7ac70e78266c4f76616 # v3.1.0
+        uses: actions/attest@daf44fb950173508f38bd2406030372c1d1162b1 # v3.0.0
        with:
          subject-name: ${{ steps.image-base-tag.outputs.tag }}
          predicate-type: "https://slsa.dev/provenance/v1"
@@ -570,7 +570,7 @@ jobs:
        id: attest_main
        if: ${{ !inputs.dry_run }}
        continue-on-error: true
-        uses: actions/attest@7667f588f2f73a90cea6c7ac70e78266c4f76616 # v3.1.0
+        uses: actions/attest@daf44fb950173508f38bd2406030372c1d1162b1 # v3.0.0
        with:
          subject-name: ${{ steps.build_docker.outputs.multiarch_image }}
          predicate-type: "https://slsa.dev/provenance/v1"
@@ -614,7 +614,7 @@ jobs:
        id: attest_latest
        if: ${{ !inputs.dry_run && steps.build_docker.outputs.created_latest_tag == 'true' }}
        continue-on-error: true
-        uses: actions/attest@7667f588f2f73a90cea6c7ac70e78266c4f76616 # v3.1.0
+        uses: actions/attest@daf44fb950173508f38bd2406030372c1d1162b1 # v3.0.0
        with:
          subject-name: ${{ steps.latest_tag.outputs.tag }}
          predicate-type: "https://slsa.dev/provenance/v1"
@@ -761,7 +761,7 @@ jobs:

      - name: Upload artifacts to actions (if dry-run)
        if: ${{ inputs.dry_run }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: release-artifacts
          path: |
@@ -777,7 +777,7 @@ jobs:

      - name: Upload latest sbom artifact to actions (if dry-run)
        if: inputs.dry_run && steps.build_docker.outputs.created_latest_tag == 'true'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: latest-sbom-artifact
          path: ./coder_latest_sbom.spdx.json
@@ -802,7 +802,7 @@ jobs:
      # TODO: skip this if it's not a new release (i.e. a backport). This is
      #       fine right now because it just makes a PR that we can close.
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -878,7 +878,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -888,7 +888,7 @@ jobs:
          GH_TOKEN: ${{ secrets.CDRCI_GITHUB_TOKEN }}

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -971,12 +971,12 @@ jobs:
    if: ${{ !inputs.dry_run }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -20,12 +20,12 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: "Checkout code"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

@@ -39,7 +39,7 @@ jobs:

      # Upload the results as artifacts.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: SARIF file
          path: results.sarif
@@ -47,6 +47,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
+        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v3.29.5
        with:
          sarif_file: results.sarif
@@ -27,12 +27,12 @@ jobs:
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

@@ -40,7 +40,7 @@ jobs:
        uses: ./.github/actions/setup-go

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
+        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v3.29.5
        with:
          languages: go, javascript

@@ -50,7 +50,7 @@ jobs:
          rm Makefile

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
+        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v3.29.5

      - name: Send Slack notification on failure
        if: ${{ failure() }}
@@ -69,12 +69,12 @@ jobs:
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -154,13 +154,13 @@ jobs:
          severity: "CRITICAL,HIGH"

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
+        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v3.29.5
        with:
          sarif_file: trivy-results.sarif
          category: "Trivy"

      - name: Upload Trivy scan results as an artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: trivy
          path: trivy-results.sarif
@@ -18,12 +18,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: stale
-        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
+        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
        with:
          stale-issue-label: "stale"
          stale-pr-label: "stale"
@@ -96,12 +96,12 @@ jobs:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - name: Run delete-old-branches-action
@@ -120,7 +120,7 @@ jobs:
      actions: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

@@ -0,0 +1,35 @@
+name: Start Workspace On Issue Creation or Comment
+
+on:
+  issues:
+    types: [opened]
+  issue_comment:
+    types: [created]
+
+permissions:
+  issues: write
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    if: >-
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@coder')) || 
+      (github.event_name == 'issues' && contains(github.event.issue.body, '@coder'))
+    environment: dev.coder.com
+    timeout-minutes: 5
+    steps:
+      - name: Start Coder workspace
+        uses: coder/start-workspace-action@f97a681b4cc7985c9eef9963750c7cc6ebc93a19
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-username: >-
+            ${{
+              (github.event_name == 'issue_comment' && github.event.comment.user.login) || 
+              (github.event_name == 'issues' && github.event.issue.user.login)
+            }}
+          coder-url: ${{ secrets.CODER_URL }}
+          coder-token: ${{ secrets.CODER_TOKEN }}
+          template-name: ${{ secrets.CODER_TEMPLATE_NAME }}
+          parameters: |-
+            AI Prompt: "Use the gh CLI tool to read the details of issue https://github.com/${{ github.repository }}/issues/${{ github.event.issue.number }} and then address it."
+            Region: us-pittsburgh
@@ -153,7 +153,7 @@ jobs:
          } >> "${GITHUB_OUTPUT}"

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 1
          path: ./.github/actions/create-task-action
@@ -21,12 +21,12 @@ jobs:
      pull-requests: write # required to post PR review comments by the action
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

@@ -3,7 +3,6 @@
 .eslintcache
 .gitpod.yml
 .idea
-.run
 **/*.swp
 gotests.coverage
 gotests.xml
@@ -211,14 +211,6 @@ issues:
    - path: scripts/rules.go
      linters:
        - ALL
-    # Boundary code is imported from github.com/coder/boundary and has different
-    # lint standards. Suppress lint issues in this imported code.
-    - path: enterprise/cli/boundary/
-      linters:
-        - revive
-        - gocritic
-        - gosec
-        - errorlint

  fix: true
  max-issues-per-linter: 0
@@ -0,0 +1,22 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-43839e83e53f40866cc8f89209a4501d40e6d3ed959c311a6f57dacaae8e68cb",
+  "author": "security@coder.com",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2025-55183"
+      },
+      "products": [
+        {
+          "@id": "pkg.go.dev/github.com/coder/coder/v2"
+        }
+      ],
+      "status": "not_affected",
+      "justification": "component_not_present",
+      "timestamp": "2025-12-12T16:51:35.795184Z"
+    }
+  ],
+  "timestamp": "2025-12-12T16:51:35Z"
+}
@@ -0,0 +1,22 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-c489cb843230acfab4918412c2c76f196d1b1f4039dc30d55063989ae30cefe9",
+  "author": "security@coder.com",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2025-55184"
+      },
+      "products": [
+        {
+          "@id": "pkg.go.dev/github.com/coder/coder/v2"
+        }
+      ],
+      "status": "not_affected",
+      "justification": "component_not_present",
+      "timestamp": "2025-12-12T16:51:35.823457Z"
+    }
+  ],
+  "timestamp": "2025-12-12T16:51:35Z"
+}
@@ -0,0 +1,22 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-f68c1895144ea700bdbfaaac7cca34a4acf80933a1c4ecd984d04665a4ae6415",
+  "author": "security@coder.com",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2025-67779"
+      },
+      "products": [
+        {
+          "@id": "pkg.go.dev/github.com/coder/coder/v2"
+        }
+      ],
+      "status": "not_affected",
+      "justification": "component_not_present",
+      "timestamp": "2025-12-12T16:51:35.84893Z"
+    }
+  ],
+  "timestamp": "2025-12-12T16:51:35Z"
+}
@@ -464,7 +464,7 @@ ifdef FILE
 	# Format single file
 	if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.go ]] && ! grep -q "DO NOT EDIT" "$(FILE)"; then \
 		echo "$(GREEN)==>$(RESET) $(BOLD)fmt/go$(RESET) $(FILE)"; \
-		./scripts/format_go_file.sh "$(FILE)"; \
+		go run mvdan.cc/gofumpt@v0.8.0 -w -l "$(FILE)"; \
 	fi
 else
 	go mod tidy
@@ -473,7 +473,7 @@ else
 	# https://github.com/mvdan/gofumpt#visual-studio-code
 	find . $(FIND_EXCLUSIONS) -type f -name '*.go' -print0 | \
 		xargs -0 grep -E --null -L '^// Code generated .* DO NOT EDIT\.$$' | \
-		xargs -0 ./scripts/format_go_file.sh
+		xargs -0 go run mvdan.cc/gofumpt@v0.8.0 -w -l
 endif
 .PHONY: fmt/go

@@ -578,7 +578,7 @@ lint/go:
 	./scripts/check_codersdk_imports.sh
 	linter_ver=$(shell egrep -o 'GOLANGCI_LINT_VERSION=\S+' dogfood/coder/Dockerfile | cut -d '=' -f 2)
 	go run github.com/golangci/golangci-lint/cmd/golangci-lint@v$$linter_ver run
-	go tool github.com/coder/paralleltestctx/cmd/paralleltestctx -custom-funcs="testutil.Context" ./...
+	go run github.com/coder/paralleltestctx/cmd/paralleltestctx@v0.0.1 -custom-funcs="testutil.Context" ./...
 .PHONY: lint/go

 lint/examples:
@@ -604,7 +604,7 @@ lint/actions: lint/actions/actionlint lint/actions/zizmor
 .PHONY: lint/actions

 lint/actions/actionlint:
-	go tool github.com/rhysd/actionlint/cmd/actionlint
+	go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
 .PHONY: lint/actions/actionlint

 lint/actions/zizmor:
@@ -1018,8 +1018,7 @@ endif

 # default to 8x8 parallelism to avoid overwhelming our workspaces. Hopefully we can remove these defaults
 # when we get our test suite's resource utilization under control.
-# Use testsmallbatch tag to reduce wireguard memory allocation in tests (from ~18GB to negligible).
-GOTEST_FLAGS := -tags=testsmallbatch -v -p $(or $(TEST_NUM_PARALLEL_PACKAGES),"8") -parallel=$(or $(TEST_NUM_PARALLEL_TESTS),"8")
+GOTEST_FLAGS := -v -p $(or $(TEST_NUM_PARALLEL_PACKAGES),"8") -parallel=$(or $(TEST_NUM_PARALLEL_TESTS),"8")

 # The most common use is to set TEST_COUNT=1 to avoid Go's test cache.
 ifdef TEST_COUNT
@@ -1034,14 +1033,6 @@ ifdef RUN
 GOTEST_FLAGS += -run $(RUN)
 endif

-ifdef TEST_CPUPROFILE
-GOTEST_FLAGS += -cpuprofile=$(TEST_CPUPROFILE)
-endif
-
-ifdef TEST_MEMPROFILE
-GOTEST_FLAGS += -memprofile=$(TEST_MEMPROFILE)
-endif
-
 TEST_PACKAGES ?= ./...

 test:
@@ -1090,7 +1081,6 @@ test-postgres: test-postgres-docker
 		--jsonfile="gotests.json" \
 		$(GOTESTSUM_RETRY_FLAGS) \
 		--packages="./..." -- \
-		-tags=testsmallbatch \
 		-timeout=20m \
 		-count=1
 .PHONY: test-postgres
@@ -1163,7 +1153,7 @@ test-postgres-docker:

 # Make sure to keep this in sync with test-go-race from .github/workflows/ci.yaml.
 test-race:
-	$(GIT_FLAGS) gotestsum --junitfile="gotests.xml" -- -tags=testsmallbatch -race -count=1 -parallel 4 -p 4 ./...
+	$(GIT_FLAGS) gotestsum --junitfile="gotests.xml" -- -race -count=1 -parallel 4 -p 4 ./...
 .PHONY: test-race

 test-tailnet-integration:
@@ -1173,7 +1163,6 @@ test-tailnet-integration:
 		TS_DEBUG_NETCHECK=true \
 		GOTRACEBACK=single \
 		go test \
-			-tags=testsmallbatch \
 			-exec "sudo -E" \
 			-timeout=5m \
 			-count=1 \
@@ -36,14 +36,13 @@ import (
 	"tailscale.com/types/netlogtype"
 	"tailscale.com/util/clientmetric"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/clistat"
 	"github.com/coder/coder/v2/agent/agentcontainers"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/agent/agentscripts"
 	"github.com/coder/coder/v2/agent/agentsocket"
 	"github.com/coder/coder/v2/agent/agentssh"
-	"github.com/coder/coder/v2/agent/boundarylogproxy"
 	"github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/agent/proto/resourcesmonitor"
 	"github.com/coder/coder/v2/agent/reconnectingpty"
@@ -72,8 +71,6 @@ const (
 	EnvProcOOMScore = "CODER_PROC_OOM_SCORE"
 )

-var ErrAgentClosing = xerrors.New("agent is closing")
-
 type Options struct {
 	Filesystem             afero.Fs
 	LogDir                 string
@@ -103,12 +100,11 @@ type Options struct {
 	Clock                        quartz.Clock
 	SocketServerEnabled          bool
 	SocketPath                   string // Path for the agent socket server socket
-	BoundaryLogProxySocketPath   string
 }

 type Client interface {
-	ConnectRPC27(ctx context.Context) (
-		proto.DRPCAgentClient27, tailnetproto.DRPCTailnetClient27, error,
+	ConnectRPC26(ctx context.Context) (
+		proto.DRPCAgentClient26, tailnetproto.DRPCTailnetClient26, error,
 	)
 	tailnet.DERPMapRewriter
 	agentsdk.RefreshableSessionTokenProvider
@@ -207,11 +203,10 @@ func New(options Options) Agent {
 		metrics:            newAgentMetrics(prometheusRegistry),
 		execer:             options.Execer,

-		devcontainers:              options.Devcontainers,
-		containerAPIOptions:        options.DevcontainerAPIOptions,
-		socketPath:                 options.SocketPath,
-		socketServerEnabled:        options.SocketServerEnabled,
-		boundaryLogProxySocketPath: options.BoundaryLogProxySocketPath,
+		devcontainers:       options.Devcontainers,
+		containerAPIOptions: options.DevcontainerAPIOptions,
+		socketPath:          options.SocketPath,
+		socketServerEnabled: options.SocketServerEnabled,
 	}
 	// Initially, we have a closed channel, reflecting the fact that we are not initially connected.
 	// Each time we connect we replace the channel (while holding the closeMutex) with a new one
@@ -280,11 +275,6 @@ type agent struct {

 	logSender *agentsdk.LogSender

-	// boundaryLogProxy is a socket server that forwards boundary audit logs to coderd.
-	// It may be nil if there is a problem starting the server.
-	boundaryLogProxy           *boundarylogproxy.Server
-	boundaryLogProxySocketPath string
-
 	prometheusRegistry *prometheus.Registry
 	// metrics are prometheus registered metrics that will be collected and
 	// labeled in Coder with the agent + workspace.
@@ -379,7 +369,6 @@ func (a *agent) init() {
 	)

 	a.initSocketServer()
-	a.startBoundaryLogProxyServer()

 	go a.runLoop()
 }
@@ -404,19 +393,6 @@ func (a *agent) initSocketServer() {
 	a.logger.Debug(a.hardCtx, "socket server started", slog.F("path", a.socketPath))
 }

-// startBoundaryLogProxyServer starts the boundary log proxy socket server.
-func (a *agent) startBoundaryLogProxyServer() {
-	proxy := boundarylogproxy.NewServer(a.logger, a.boundaryLogProxySocketPath)
-	if err := proxy.Start(); err != nil {
-		a.logger.Warn(a.hardCtx, "failed to start boundary log proxy", slog.Error(err))
-		return
-	}
-
-	a.boundaryLogProxy = proxy
-	a.logger.Info(a.hardCtx, "boundary log proxy server started",
-		slog.F("socket_path", a.boundaryLogProxySocketPath))
-}
-
 // runLoop attempts to start the agent in a retry loop.
 // Coder may be offline temporarily, a connection issue
 // may be happening, but regardless after the intermittent
@@ -425,7 +401,6 @@ func (a *agent) runLoop() {
 	// need to keep retrying up to the hardCtx so that we can send graceful shutdown-related
 	// messages.
 	ctx := a.hardCtx
-	defer a.logger.Info(ctx, "agent main loop exited")
 	for retrier := retry.New(100*time.Millisecond, 10*time.Second); retrier.Wait(ctx); {
 		a.logger.Info(ctx, "connecting to coderd")
 		err := a.run()
@@ -528,7 +503,7 @@ func (t *trySingleflight) Do(key string, fn func()) {
 	fn()
 }

-func (a *agent) reportMetadata(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+func (a *agent) reportMetadata(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 	tickerDone := make(chan struct{})
 	collectDone := make(chan struct{})
 	ctx, cancel := context.WithCancel(ctx)
@@ -743,7 +718,7 @@ func (a *agent) reportMetadata(ctx context.Context, aAPI proto.DRPCAgentClient27

 // reportLifecycle reports the current lifecycle state once. All state
 // changes are reported in order.
-func (a *agent) reportLifecycle(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+func (a *agent) reportLifecycle(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 	for {
 		select {
 		case <-a.lifecycleUpdate:
@@ -823,7 +798,7 @@ func (a *agent) setLifecycle(state codersdk.WorkspaceAgentLifecycle) {
 }

 // reportConnectionsLoop reports connections to the agent for auditing.
-func (a *agent) reportConnectionsLoop(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+func (a *agent) reportConnectionsLoop(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 	for {
 		select {
 		case <-a.reportConnectionsUpdate:
@@ -954,7 +929,7 @@ func (a *agent) reportConnection(id uuid.UUID, connectionType proto.Connection_T
 // fetchServiceBannerLoop fetches the service banner on an interval.  It will
 // not be fetched immediately; the expectation is that it is primed elsewhere
 // (and must be done before the session actually starts).
-func (a *agent) fetchServiceBannerLoop(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+func (a *agent) fetchServiceBannerLoop(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 	ticker := time.NewTicker(a.announcementBannersRefreshInterval)
 	defer ticker.Stop()
 	for {
@@ -989,7 +964,7 @@ func (a *agent) run() (retErr error) {
 	}

 	// ConnectRPC returns the dRPC connection we use for the Agent and Tailnet v2+ APIs
-	aAPI, tAPI, err := a.client.ConnectRPC27(a.hardCtx)
+	aAPI, tAPI, err := a.client.ConnectRPC26(a.hardCtx)
 	if err != nil {
 		return err
 	}
@@ -1006,7 +981,7 @@ func (a *agent) run() (retErr error) {
 	connMan := newAPIConnRoutineManager(a.gracefulCtx, a.hardCtx, a.logger, aAPI, tAPI)

 	connMan.startAgentAPI("init notification banners", gracefulShutdownBehaviorStop,
-		func(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+		func(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 			bannersProto, err := aAPI.GetAnnouncementBanners(ctx, &proto.GetAnnouncementBannersRequest{})
 			if err != nil {
 				return xerrors.Errorf("fetch service banner: %w", err)
@@ -1023,7 +998,7 @@ func (a *agent) run() (retErr error) {
 	// sending logs gets gracefulShutdownBehaviorRemain because we want to send logs generated by
 	// shutdown scripts.
 	connMan.startAgentAPI("send logs", gracefulShutdownBehaviorRemain,
-		func(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+		func(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 			err := a.logSender.SendLoop(ctx, aAPI)
 			if xerrors.Is(err, agentsdk.ErrLogLimitExceeded) {
 				// we don't want this error to tear down the API connection and propagate to the
@@ -1034,15 +1009,6 @@ func (a *agent) run() (retErr error) {
 			return err
 		})

-	// Forward boundary audit logs to coderd if boundary log forwarding is enabled.
-	// These are audit logs so they should continue during graceful shutdown.
-	if a.boundaryLogProxy != nil {
-		proxyFunc := func(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
-			return a.boundaryLogProxy.RunForwarder(ctx, aAPI)
-		}
-		connMan.startAgentAPI("boundary log proxy", gracefulShutdownBehaviorRemain, proxyFunc)
-	}
-
 	// part of graceful shut down is reporting the final lifecycle states, e.g "ShuttingDown" so the
 	// lifecycle reporting has to be via gracefulShutdownBehaviorRemain
 	connMan.startAgentAPI("report lifecycle", gracefulShutdownBehaviorRemain, a.reportLifecycle)
@@ -1051,7 +1017,7 @@ func (a *agent) run() (retErr error) {
 	connMan.startAgentAPI("report metadata", gracefulShutdownBehaviorStop, a.reportMetadata)

 	// resources monitor can cease as soon as we start gracefully shutting down.
-	connMan.startAgentAPI("resources monitor", gracefulShutdownBehaviorStop, func(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+	connMan.startAgentAPI("resources monitor", gracefulShutdownBehaviorStop, func(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 		logger := a.logger.Named("resources_monitor")
 		clk := quartz.NewReal()
 		config, err := aAPI.GetResourcesMonitoringConfiguration(ctx, &proto.GetResourcesMonitoringConfigurationRequest{})
@@ -1098,7 +1064,7 @@ func (a *agent) run() (retErr error) {
 	connMan.startAgentAPI("handle manifest", gracefulShutdownBehaviorStop, a.handleManifest(manifestOK))

 	connMan.startAgentAPI("app health reporter", gracefulShutdownBehaviorStop,
-		func(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+		func(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 			if err := manifestOK.wait(ctx); err != nil {
 				return xerrors.Errorf("no manifest: %w", err)
 			}
@@ -1131,7 +1097,7 @@ func (a *agent) run() (retErr error) {

 	connMan.startAgentAPI("fetch service banner loop", gracefulShutdownBehaviorStop, a.fetchServiceBannerLoop)

-	connMan.startAgentAPI("stats report loop", gracefulShutdownBehaviorStop, func(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+	connMan.startAgentAPI("stats report loop", gracefulShutdownBehaviorStop, func(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 		if err := networkOK.wait(ctx); err != nil {
 			return xerrors.Errorf("no network: %w", err)
 		}
@@ -1146,8 +1112,8 @@ func (a *agent) run() (retErr error) {
 }

 // handleManifest returns a function that fetches and processes the manifest
-func (a *agent) handleManifest(manifestOK *checkpoint) func(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
-	return func(ctx context.Context, aAPI proto.DRPCAgentClient27) error {
+func (a *agent) handleManifest(manifestOK *checkpoint) func(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
+	return func(ctx context.Context, aAPI proto.DRPCAgentClient26) error {
 		var (
 			sentResult = false
 			err        error
@@ -1310,7 +1276,7 @@ func (a *agent) handleManifest(manifestOK *checkpoint) func(ctx context.Context,

 func (a *agent) createDevcontainer(
 	ctx context.Context,
-	aAPI proto.DRPCAgentClient27,
+	aAPI proto.DRPCAgentClient26,
 	dc codersdk.WorkspaceAgentDevcontainer,
 	script codersdk.WorkspaceAgentScript,
 ) (err error) {
@@ -1342,8 +1308,8 @@ func (a *agent) createDevcontainer(

 // createOrUpdateNetwork waits for the manifest to be set using manifestOK, then creates or updates
 // the tailnet using the information in the manifest
-func (a *agent) createOrUpdateNetwork(manifestOK, networkOK *checkpoint) func(context.Context, proto.DRPCAgentClient27) error {
-	return func(ctx context.Context, aAPI proto.DRPCAgentClient27) (retErr error) {
+func (a *agent) createOrUpdateNetwork(manifestOK, networkOK *checkpoint) func(context.Context, proto.DRPCAgentClient26) error {
+	return func(ctx context.Context, aAPI proto.DRPCAgentClient26) (retErr error) {
 		if err := manifestOK.wait(ctx); err != nil {
 			return xerrors.Errorf("no manifest: %w", err)
 		}
@@ -1382,7 +1348,7 @@ func (a *agent) createOrUpdateNetwork(manifestOK, networkOK *checkpoint) func(co
 			a.closeMutex.Unlock()
 			if closing {
 				_ = network.Close()
-				return xerrors.Errorf("agent closed while creating tailnet: %w", ErrAgentClosing)
+				return xerrors.New("agent is closing")
 			}
 		} else {
 			// Update the wireguard IPs if the agent ID changed.
@@ -1432,7 +1398,6 @@ func (a *agent) updateCommandEnv(current []string) (updated []string, err error)
 		"CODER_WORKSPACE_NAME":       manifest.WorkspaceName,
 		"CODER_WORKSPACE_AGENT_NAME": manifest.AgentName,
 		"CODER_WORKSPACE_OWNER_NAME": manifest.OwnerName,
-		"CODER_WORKSPACE_ID":         manifest.WorkspaceID.String(),

 		// Specific Coder subcommands require the agent token exposed!
 		"CODER_AGENT_TOKEN": a.client.GetSessionToken(),
@@ -1506,7 +1471,7 @@ func (a *agent) trackGoroutine(fn func()) error {
 	a.closeMutex.Lock()
 	defer a.closeMutex.Unlock()
 	if a.closing {
-		return xerrors.Errorf("track conn goroutine: %w", ErrAgentClosing)
+		return xerrors.New("track conn goroutine: agent is closing")
 	}
 	a.closeWaitGroup.Add(1)
 	go func() {
@@ -2013,13 +1978,6 @@ func (a *agent) Close() error {
 		a.logger.Error(a.hardCtx, "container API close", slog.Error(err))
 	}

-	if a.boundaryLogProxy != nil {
-		err = a.boundaryLogProxy.Close()
-		if err != nil {
-			a.logger.Warn(context.Background(), "close boundary log proxy", slog.Error(err))
-		}
-	}
-
 	// Wait for the graceful shutdown to complete, but don't wait forever so
 	// that we don't break user expectations.
 	go func() {
@@ -2137,7 +2095,7 @@ const (

 type apiConnRoutineManager struct {
 	logger    slog.Logger
-	aAPI      proto.DRPCAgentClient27
+	aAPI      proto.DRPCAgentClient26
 	tAPI      tailnetproto.DRPCTailnetClient24
 	eg        *errgroup.Group
 	stopCtx   context.Context
@@ -2146,7 +2104,7 @@ type apiConnRoutineManager struct {

 func newAPIConnRoutineManager(
 	gracefulCtx, hardCtx context.Context, logger slog.Logger,
-	aAPI proto.DRPCAgentClient27, tAPI tailnetproto.DRPCTailnetClient24,
+	aAPI proto.DRPCAgentClient26, tAPI tailnetproto.DRPCTailnetClient24,
 ) *apiConnRoutineManager {
 	// routines that remain in operation during graceful shutdown use the remainCtx.  They'll still
 	// exit if the errgroup hits an error, which usually means a problem with the conn.
@@ -2179,7 +2137,7 @@ func newAPIConnRoutineManager(
 // but for Tailnet.
 func (a *apiConnRoutineManager) startAgentAPI(
 	name string, behavior gracefulShutdownBehavior,
-	f func(context.Context, proto.DRPCAgentClient27) error,
+	f func(context.Context, proto.DRPCAgentClient26) error,
 ) {
 	logger := a.logger.With(slog.F("name", name))
 	var ctx context.Context
@@ -2194,7 +2152,16 @@ func (a *apiConnRoutineManager) startAgentAPI(
 	a.eg.Go(func() error {
 		logger.Debug(ctx, "starting agent routine")
 		err := f(ctx, a.aAPI)
-		err = shouldPropagateError(ctx, logger, err)
+		if xerrors.Is(err, context.Canceled) && ctx.Err() != nil {
+			logger.Debug(ctx, "swallowing context canceled")
+			// Don't propagate context canceled errors to the error group, because we don't want the
+			// graceful context being canceled to halt the work of routines with
+			// gracefulShutdownBehaviorRemain.  Note that we check both that the error is
+			// context.Canceled and that *our* context is currently canceled, because when Coderd
+			// unilaterally closes the API connection (for example if the build is outdated), it can
+			// sometimes show up as context.Canceled in our RPC calls.
+			return nil
+		}
 		logger.Debug(ctx, "routine exited", slog.Error(err))
 		if err != nil {
 			return xerrors.Errorf("error in routine %s: %w", name, err)
@@ -2222,7 +2189,21 @@ func (a *apiConnRoutineManager) startTailnetAPI(
 	a.eg.Go(func() error {
 		logger.Debug(ctx, "starting tailnet routine")
 		err := f(ctx, a.tAPI)
-		err = shouldPropagateError(ctx, logger, err)
+		if (xerrors.Is(err, context.Canceled) ||
+			xerrors.Is(err, io.EOF)) &&
+			ctx.Err() != nil {
+			logger.Debug(ctx, "swallowing error because context is canceled", slog.Error(err))
+			// Don't propagate context canceled errors to the error group, because we don't want the
+			// graceful context being canceled to halt the work of routines with
+			// gracefulShutdownBehaviorRemain. Unfortunately, the dRPC library closes the stream
+			// when context is canceled on an RPC, so canceling the context can also show up as
+			// io.EOF. Also, when Coderd unilaterally closes the API connection (for example if the
+			// build is outdated), it can sometimes show up as context.Canceled in our RPC calls.
+			// We can't reliably distinguish between a context cancelation and a legit EOF, so we
+			// also check that *our* context is currently canceled. If it is, we can safely ignore
+			// the error.
+			return nil
+		}
 		logger.Debug(ctx, "routine exited", slog.Error(err))
 		if err != nil {
 			return xerrors.Errorf("error in routine %s: %w", name, err)
@@ -2231,34 +2212,6 @@ func (a *apiConnRoutineManager) startTailnetAPI(
 	})
 }

-// shouldPropagateError decides whether an error from an API connection routine should be propagated to the
-// apiConnRoutineManager. Its purpose is to prevent errors related to shutting down from propagating to the manager's
-// error group, which will tear down the API connection and potentially stop graceful shutdown from succeeding.
-func shouldPropagateError(ctx context.Context, logger slog.Logger, err error) error {
-	if (xerrors.Is(err, context.Canceled) ||
-		xerrors.Is(err, io.EOF)) &&
-		ctx.Err() != nil {
-		logger.Debug(ctx, "swallowing error because context is canceled", slog.Error(err))
-		// Don't propagate context canceled errors to the error group, because we don't want the
-		// graceful context being canceled to halt the work of routines with
-		// gracefulShutdownBehaviorRemain. Unfortunately, the dRPC library closes the stream
-		// when context is canceled on an RPC, so canceling the context can also show up as
-		// io.EOF. Also, when Coderd unilaterally closes the API connection (for example if the
-		// build is outdated), it can sometimes show up as context.Canceled in our RPC calls.
-		// We can't reliably distinguish between a context cancelation and a legit EOF, so we
-		// also check that *our* context is currently canceled. If it is, we can safely ignore
-		// the error.
-		return nil
-	}
-	if xerrors.Is(err, ErrAgentClosing) {
-		logger.Debug(ctx, "swallowing error because agent is closing")
-		// This can only be generated when the agent is closing, so we never want it to propagate to other routines.
-		// (They are signaled to exit via canceled contexts.)
-		return nil
-	}
-	return err
-}
-
 func (a *apiConnRoutineManager) wait() error {
 	return a.eg.Wait()
 }
@@ -6,8 +6,9 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/slogtest"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+
 	"github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/testutil"
 )
@@ -25,6 +25,10 @@ import (
 	"testing"
 	"time"

+	"go.uber.org/goleak"
+	"tailscale.com/net/speedtest"
+	"tailscale.com/tailcfg"
+
 	"github.com/bramvdbogaerde/go-scp"
 	"github.com/google/uuid"
 	"github.com/ory/dockertest/v3"
@@ -36,14 +40,12 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.uber.org/goleak"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/xerrors"
-	"tailscale.com/net/speedtest"
-	"tailscale.com/tailcfg"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/slogtest"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+
 	"github.com/coder/coder/v2/agent"
 	"github.com/coder/coder/v2/agent/agentcontainers"
 	"github.com/coder/coder/v2/agent/agentssh"
@@ -945,7 +947,7 @@ func TestAgent_UnixLocalForwarding(t *testing.T) {
 		t.Skip("unix domain sockets are not fully supported on Windows")
 	}
 	ctx := testutil.Context(t, testutil.WaitLong)
-	tmpdir := testutil.TempDirUnixSocket(t)
+	tmpdir := tempDirUnixSocket(t)
 	remoteSocketPath := filepath.Join(tmpdir, "remote-socket")

 	l, err := net.Listen("unix", remoteSocketPath)
@@ -973,7 +975,7 @@ func TestAgent_UnixRemoteForwarding(t *testing.T) {
 		t.Skip("unix domain sockets are not fully supported on Windows")
 	}

-	tmpdir := testutil.TempDirUnixSocket(t)
+	tmpdir := tempDirUnixSocket(t)
 	remoteSocketPath := filepath.Join(tmpdir, "remote-socket")

 	ctx := testutil.Context(t, testutil.WaitLong)
@@ -992,77 +994,42 @@ func TestAgent_UnixRemoteForwarding(t *testing.T) {

 func TestAgent_SFTP(t *testing.T) {
 	t.Parallel()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+	u, err := user.Current()
+	require.NoError(t, err, "get current user")
+	home := u.HomeDir
+	if runtime.GOOS == "windows" {
+		home = "/" + strings.ReplaceAll(home, "\\", "/")
+	}
+	//nolint:dogsled
+	conn, agentClient, _, _, _ := setupAgent(t, agentsdk.Manifest{}, 0)
+	sshClient, err := conn.SSHClient(ctx)
+	require.NoError(t, err)
+	defer sshClient.Close()
+	client, err := sftp.NewClient(sshClient)
+	require.NoError(t, err)
+	defer client.Close()
+	wd, err := client.Getwd()
+	require.NoError(t, err, "get working directory")
+	require.Equal(t, home, wd, "working directory should be home user home")
+	tempFile := filepath.Join(t.TempDir(), "sftp")
+	// SFTP only accepts unix-y paths.
+	remoteFile := filepath.ToSlash(tempFile)
+	if !path.IsAbs(remoteFile) {
+		// On Windows, e.g. "/C:/Users/...".
+		remoteFile = path.Join("/", remoteFile)
+	}
+	file, err := client.Create(remoteFile)
+	require.NoError(t, err)
+	err = file.Close()
+	require.NoError(t, err)
+	_, err = os.Stat(tempFile)
+	require.NoError(t, err)

-	t.Run("DefaultWorkingDirectory", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
-		u, err := user.Current()
-		require.NoError(t, err, "get current user")
-		home := u.HomeDir
-		if runtime.GOOS == "windows" {
-			home = "/" + strings.ReplaceAll(home, "\\", "/")
-		}
-		//nolint:dogsled
-		conn, agentClient, _, _, _ := setupAgent(t, agentsdk.Manifest{}, 0)
-		sshClient, err := conn.SSHClient(ctx)
-		require.NoError(t, err)
-		defer sshClient.Close()
-		client, err := sftp.NewClient(sshClient)
-		require.NoError(t, err)
-		defer client.Close()
-		wd, err := client.Getwd()
-		require.NoError(t, err, "get working directory")
-		require.Equal(t, home, wd, "working directory should be user home")
-		tempFile := filepath.Join(t.TempDir(), "sftp")
-		// SFTP only accepts unix-y paths.
-		remoteFile := filepath.ToSlash(tempFile)
-		if !path.IsAbs(remoteFile) {
-			// On Windows, e.g. "/C:/Users/...".
-			remoteFile = path.Join("/", remoteFile)
-		}
-		file, err := client.Create(remoteFile)
-		require.NoError(t, err)
-		err = file.Close()
-		require.NoError(t, err)
-		_, err = os.Stat(tempFile)
-		require.NoError(t, err)
-
-		// Close the client to trigger disconnect event.
-		_ = client.Close()
-		assertConnectionReport(t, agentClient, proto.Connection_SSH, 0, "")
-	})
-
-	t.Run("CustomWorkingDirectory", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
-
-		// Create a custom directory for the agent to use.
-		customDir := t.TempDir()
-		expectedDir := customDir
-		if runtime.GOOS == "windows" {
-			expectedDir = "/" + strings.ReplaceAll(customDir, "\\", "/")
-		}
-
-		//nolint:dogsled
-		conn, agentClient, _, _, _ := setupAgent(t, agentsdk.Manifest{
-			Directory: customDir,
-		}, 0)
-		sshClient, err := conn.SSHClient(ctx)
-		require.NoError(t, err)
-		defer sshClient.Close()
-		client, err := sftp.NewClient(sshClient)
-		require.NoError(t, err)
-		defer client.Close()
-		wd, err := client.Getwd()
-		require.NoError(t, err, "get working directory")
-		require.Equal(t, expectedDir, wd, "working directory should be custom directory")
-
-		// Close the client to trigger disconnect event.
-		_ = client.Close()
-		assertConnectionReport(t, agentClient, proto.Connection_SSH, 0, "")
-	})
+	// Close the client to trigger disconnect event.
+	_ = client.Close()
+	assertConnectionReport(t, agentClient, proto.Connection_SSH, 0, "")
 }

 func TestAgent_SCP(t *testing.T) {
@@ -3464,6 +3431,29 @@ func testSessionOutput(t *testing.T, session *ssh.Session, expected, unexpected
 	}
 }

+// tempDirUnixSocket returns a temporary directory that can safely hold unix
+// sockets (probably).
+//
+// During tests on darwin we hit the max path length limit for unix sockets
+// pretty easily in the default location, so this function uses /tmp instead to
+// get shorter paths.
+func tempDirUnixSocket(t *testing.T) string {
+	t.Helper()
+	if runtime.GOOS == "darwin" {
+		testName := strings.ReplaceAll(t.Name(), "/", "_")
+		dir, err := os.MkdirTemp("/tmp", fmt.Sprintf("coder-test-%s-", testName))
+		require.NoError(t, err, "create temp dir for gpg test")
+
+		t.Cleanup(func() {
+			err := os.RemoveAll(dir)
+			assert.NoError(t, err, "remove temp dir", dir)
+		})
+		return dir
+	}
+
+	return t.TempDir()
+}
+
 func TestAgent_Metrics_SSH(t *testing.T) {
 	t.Parallel()
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -106,34 +106,6 @@ func (mr *MockContainerCLIMockRecorder) List(ctx any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "List", reflect.TypeOf((*MockContainerCLI)(nil).List), ctx)
 }

-// Remove mocks base method.
-func (m *MockContainerCLI) Remove(ctx context.Context, containerName string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Remove", ctx, containerName)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// Remove indicates an expected call of Remove.
-func (mr *MockContainerCLIMockRecorder) Remove(ctx, containerName any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Remove", reflect.TypeOf((*MockContainerCLI)(nil).Remove), ctx, containerName)
-}
-
-// Stop mocks base method.
-func (m *MockContainerCLI) Stop(ctx context.Context, containerName string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Stop", ctx, containerName)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// Stop indicates an expected call of Stop.
-func (mr *MockContainerCLIMockRecorder) Stop(ctx, containerName any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Stop", reflect.TypeOf((*MockContainerCLI)(nil).Stop), ctx, containerName)
-}
-
 // MockDevcontainerCLI is a mock of DevcontainerCLI interface.
 type MockDevcontainerCLI struct {
 	ctrl     *gomock.Controller
@@ -26,13 +26,12 @@ import (
 	"github.com/spf13/afero"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentcontainers/ignore"
 	"github.com/coder/coder/v2/agent/agentcontainers/watcher"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/agent/usershell"
 	"github.com/coder/coder/v2/coderd/httpapi"
-	"github.com/coder/coder/v2/coderd/httpapi/httperror"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"
 	"github.com/coder/coder/v2/provisioner"
@@ -87,8 +86,7 @@ type API struct {
 	agentDirectory string

 	mu                       sync.RWMutex  // Protects the following fields.
-	initDone                 bool          // Whether Init has been called.
-	initialUpdateDone        chan struct{} // Closed after first updateContainers call in updaterLoop.
+	initDone                 chan struct{} // Closed by Init.
 	updateChans              []chan struct{}
 	closed                   bool
 	containers               codersdk.WorkspaceAgentListContainersResponse  // Output from the last list operation.
@@ -326,7 +324,7 @@ func NewAPI(logger slog.Logger, options ...Option) *API {
 	api := &API{
 		ctx:                         ctx,
 		cancel:                      cancel,
-		initialUpdateDone:           make(chan struct{}),
+		initDone:                    make(chan struct{}),
 		updateTrigger:               make(chan chan error),
 		updateInterval:              defaultUpdateInterval,
 		logger:                      logger,
@@ -380,15 +378,20 @@ func NewAPI(logger slog.Logger, options ...Option) *API {
 	return api
 }

-// Init applies a final set of options to the API and marks
-// initialization as done. This method can only be called once.
+// Init applies a final set of options to the API and then
+// closes initDone. This method can only be called once.
 func (api *API) Init(opts ...Option) {
 	api.mu.Lock()
 	defer api.mu.Unlock()
-	if api.closed || api.initDone {
+	if api.closed {
 		return
 	}
-	api.initDone = true
+	select {
+	case <-api.initDone:
+		return
+	default:
+	}
+	defer close(api.initDone)

 	for _, opt := range opts {
 		opt(api)
@@ -647,7 +650,6 @@ func (api *API) updaterLoop() {
 	} else {
 		api.logger.Debug(api.ctx, "initial containers update complete")
 	}
-	close(api.initialUpdateDone)

 	// We utilize a TickerFunc here instead of a regular Ticker so that
 	// we can guarantee execution of the updateContainers method after
@@ -712,7 +714,7 @@ func (api *API) UpdateSubAgentClient(client SubAgentClient) {
 func (api *API) Routes() http.Handler {
 	r := chi.NewRouter()

-	ensureInitialUpdateDoneMW := func(next http.Handler) http.Handler {
+	ensureInitDoneMW := func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			select {
 			case <-api.ctx.Done():
@@ -723,8 +725,8 @@ func (api *API) Routes() http.Handler {
 				return
 			case <-r.Context().Done():
 				return
-			case <-api.initialUpdateDone:
-				// Initial update is done, we can start processing requests.
+			case <-api.initDone:
+				// API init is done, we can start processing requests.
 			}
 			next.ServeHTTP(rw, r)
 		})
@@ -733,7 +735,7 @@ func (api *API) Routes() http.Handler {
 	// For now, all endpoints require the initial update to be done.
 	// If we want to allow some endpoints to be available before
 	// the initial update, we can enable this per-route.
-	r.Use(ensureInitialUpdateDoneMW)
+	r.Use(ensureInitDoneMW)

 	r.Get("/", api.handleList)
 	r.Get("/watch", api.watchContainers)
@@ -741,14 +743,11 @@ func (api *API) Routes() http.Handler {
 	// /-route was dropped. We can drop the /devcontainers prefix here too.
 	r.Route("/devcontainers/{devcontainer}", func(r chi.Router) {
 		r.Post("/recreate", api.handleDevcontainerRecreate)
-		r.Delete("/", api.handleDevcontainerDelete)
 	})

 	return r
 }

-// broadcastUpdatesLocked sends the current state to any listening clients.
-// This method assumes that api.mu is held.
 func (api *API) broadcastUpdatesLocked() {
 	// Broadcast state changes to WebSocket listeners.
 	for _, ch := range api.updateChans {
@@ -1020,12 +1019,6 @@ func (api *API) processUpdatedContainersLocked(ctx context.Context, updated code
 		case dc.Status == codersdk.WorkspaceAgentDevcontainerStatusStarting:
 			continue // This state is handled by the recreation routine.

-		case dc.Status == codersdk.WorkspaceAgentDevcontainerStatusStopping:
-			continue // This state is handled by the stopping routine.
-
-		case dc.Status == codersdk.WorkspaceAgentDevcontainerStatusDeleting:
-			continue // This state is handled by the delete routine.
-
 		case dc.Status == codersdk.WorkspaceAgentDevcontainerStatusError && (dc.Container == nil || dc.Container.CreatedAt.Before(api.recreateErrorTimes[dc.WorkspaceFolder])):
 			continue // The devcontainer needs to be recreated.

@@ -1231,155 +1224,6 @@ func (api *API) getContainers() (codersdk.WorkspaceAgentListContainersResponse,
 	}, nil
 }

-// devcontainerByIDLocked attempts to find a devcontainer by its ID.
-// This method assumes that api.mu is held.
-func (api *API) devcontainerByIDLocked(devcontainerID string) (codersdk.WorkspaceAgentDevcontainer, error) {
-	for _, knownDC := range api.knownDevcontainers {
-		if knownDC.ID.String() == devcontainerID {
-			return knownDC, nil
-		}
-	}
-
-	return codersdk.WorkspaceAgentDevcontainer{}, httperror.NewResponseError(http.StatusNotFound, codersdk.Response{
-		Message: "Devcontainer not found.",
-		Detail:  fmt.Sprintf("Could not find devcontainer with ID: %q", devcontainerID),
-	})
-}
-
-func (api *API) handleDevcontainerDelete(w http.ResponseWriter, r *http.Request) {
-	var (
-		ctx            = r.Context()
-		devcontainerID = chi.URLParam(r, "devcontainer")
-	)
-
-	if devcontainerID == "" {
-		httpapi.Write(ctx, w, http.StatusBadRequest, codersdk.Response{
-			Message: "Missing devcontainer ID",
-			Detail:  "Devcontainer ID is required to delete a devcontainer.",
-		})
-		return
-	}
-
-	api.mu.Lock()
-
-	dc, err := api.devcontainerByIDLocked(devcontainerID)
-	if err != nil {
-		api.mu.Unlock()
-		httperror.WriteResponseError(ctx, w, err)
-		return
-	}
-
-	// NOTE(DanielleMaywood):
-	// We currently do not support canceling the startup of a dev container.
-	if dc.Status.Transitioning() {
-		api.mu.Unlock()
-
-		httpapi.Write(ctx, w, http.StatusConflict, codersdk.Response{
-			Message: "Unable to delete transitioning devcontainer",
-			Detail:  fmt.Sprintf("Devcontainer %q is currently %s and cannot be deleted.", dc.Name, dc.Status),
-		})
-		return
-	}
-
-	var (
-		containerID string
-		subAgentID  uuid.UUID
-	)
-	if dc.Container != nil {
-		containerID = dc.Container.ID
-	}
-	if proc, hasSubAgent := api.injectedSubAgentProcs[dc.WorkspaceFolder]; hasSubAgent && proc.agent.ID != uuid.Nil {
-		subAgentID = proc.agent.ID
-		proc.stop()
-	}
-
-	dc.Status = codersdk.WorkspaceAgentDevcontainerStatusStopping
-	dc.Error = ""
-	api.knownDevcontainers[dc.WorkspaceFolder] = dc
-	api.broadcastUpdatesLocked()
-	api.mu.Unlock()
-
-	// Stop and remove the container if it exists.
-	if containerID != "" {
-		if err := api.ccli.Stop(ctx, containerID); err != nil {
-			api.logger.Error(ctx, "unable to stop container", slog.Error(err))
-
-			api.mu.Lock()
-			dc.Status = codersdk.WorkspaceAgentDevcontainerStatusError
-			dc.Error = err.Error()
-			api.knownDevcontainers[dc.WorkspaceFolder] = dc
-			api.broadcastUpdatesLocked()
-			api.mu.Unlock()
-
-			httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{
-				Message: "An error occurred stopping the container",
-				Detail:  err.Error(),
-			})
-			return
-		}
-	}
-
-	api.mu.Lock()
-	dc.Status = codersdk.WorkspaceAgentDevcontainerStatusDeleting
-	dc.Error = ""
-	api.knownDevcontainers[dc.WorkspaceFolder] = dc
-	api.broadcastUpdatesLocked()
-	api.mu.Unlock()
-
-	if containerID != "" {
-		if err := api.ccli.Remove(ctx, containerID); err != nil {
-			api.logger.Error(ctx, "unable to remove container", slog.Error(err))
-
-			api.mu.Lock()
-			dc.Status = codersdk.WorkspaceAgentDevcontainerStatusError
-			dc.Error = err.Error()
-			api.knownDevcontainers[dc.WorkspaceFolder] = dc
-			api.broadcastUpdatesLocked()
-			api.mu.Unlock()
-
-			httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{
-				Message: "An error occurred removing the container",
-				Detail:  err.Error(),
-			})
-			return
-		}
-	}
-
-	// Delete the subagent if it exists.
-	if subAgentID != uuid.Nil {
-		client := *api.subAgentClient.Load()
-		if err := client.Delete(ctx, subAgentID); err != nil {
-			api.logger.Error(ctx, "unable to delete agent", slog.Error(err))
-
-			api.mu.Lock()
-			dc.Status = codersdk.WorkspaceAgentDevcontainerStatusError
-			dc.Error = err.Error()
-			api.knownDevcontainers[dc.WorkspaceFolder] = dc
-			api.broadcastUpdatesLocked()
-			api.mu.Unlock()
-
-			httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{
-				Message: "An error occurred deleting the agent",
-				Detail:  err.Error(),
-			})
-			return
-		}
-	}
-
-	api.mu.Lock()
-	delete(api.devcontainerNames, dc.Name)
-	delete(api.knownDevcontainers, dc.WorkspaceFolder)
-	delete(api.devcontainerLogSourceIDs, dc.WorkspaceFolder)
-	delete(api.recreateSuccessTimes, dc.WorkspaceFolder)
-	delete(api.recreateErrorTimes, dc.WorkspaceFolder)
-	delete(api.usingWorkspaceFolderName, dc.WorkspaceFolder)
-	delete(api.injectedSubAgentProcs, dc.WorkspaceFolder)
-	api.broadcastUpdatesLocked()
-	api.mu.Unlock()
-
-	httpapi.Write(ctx, w, http.StatusNoContent, nil)
-}
-
 // handleDevcontainerRecreate handles the HTTP request to recreate a
 // devcontainer by referencing the container.
 func (api *API) handleDevcontainerRecreate(w http.ResponseWriter, r *http.Request) {
@@ -1396,18 +1240,28 @@ func (api *API) handleDevcontainerRecreate(w http.ResponseWriter, r *http.Reques

 	api.mu.Lock()

-	dc, err := api.devcontainerByIDLocked(devcontainerID)
-	if err != nil {
+	var dc codersdk.WorkspaceAgentDevcontainer
+	for _, knownDC := range api.knownDevcontainers {
+		if knownDC.ID.String() == devcontainerID {
+			dc = knownDC
+			break
+		}
+	}
+	if dc.ID == uuid.Nil {
 		api.mu.Unlock()
-		httperror.WriteResponseError(ctx, w, err)
+
+		httpapi.Write(ctx, w, http.StatusNotFound, codersdk.Response{
+			Message: "Devcontainer not found.",
+			Detail:  fmt.Sprintf("Could not find devcontainer with ID: %q", devcontainerID),
+		})
 		return
 	}
-	if dc.Status.Transitioning() {
+	if dc.Status == codersdk.WorkspaceAgentDevcontainerStatusStarting {
 		api.mu.Unlock()

 		httpapi.Write(ctx, w, http.StatusConflict, codersdk.Response{
-			Message: "Unable to recreate transitioning devcontainer",
-			Detail:  fmt.Sprintf("Devcontainer %q is currently %s and cannot be restarted.", dc.Name, dc.Status),
+			Message: "Devcontainer recreation already in progress",
+			Detail:  fmt.Sprintf("Recreation for devcontainer %q is already underway.", dc.Name),
 		})
 		return
 	}
@@ -27,14 +27,13 @@ import (
 	"go.uber.org/mock/gomock"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/sloghuman"
-	"cdr.dev/slog/v3/sloggers/slogtest"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+	"cdr.dev/slog/sloggers/slogtest"
 	"github.com/coder/coder/v2/agent/agentcontainers"
 	"github.com/coder/coder/v2/agent/agentcontainers/acmock"
 	"github.com/coder/coder/v2/agent/agentcontainers/watcher"
 	"github.com/coder/coder/v2/agent/usershell"
-	"github.com/coder/coder/v2/coderd/util/slice"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/pty"
 	"github.com/coder/coder/v2/testutil"
@@ -45,15 +44,12 @@ import (
 // fakeContainerCLI implements the agentcontainers.ContainerCLI interface for
 // testing.
 type fakeContainerCLI struct {
-	mu         sync.Mutex
 	containers codersdk.WorkspaceAgentListContainersResponse
 	listErr    error
 	arch       string
 	archErr    error
 	copyErr    error
 	execErr    error
-	stopErr    error
-	removeErr  error
 }

 func (f *fakeContainerCLI) List(_ context.Context) (codersdk.WorkspaceAgentListContainersResponse, error) {
@@ -72,32 +68,6 @@ func (f *fakeContainerCLI) ExecAs(ctx context.Context, name, user string, args .
 	return nil, f.execErr
 }

-func (f *fakeContainerCLI) Stop(ctx context.Context, name string) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	f.containers.Devcontainers = slice.Filter(f.containers.Devcontainers, func(dc codersdk.WorkspaceAgentDevcontainer) bool {
-		return dc.Container.ID == name
-	})
-	for i, container := range f.containers.Containers {
-		container.Running = false
-		f.containers.Containers[i] = container
-	}
-
-	return f.stopErr
-}
-
-func (f *fakeContainerCLI) Remove(ctx context.Context, name string) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	f.containers.Containers = slice.Filter(f.containers.Containers, func(container codersdk.WorkspaceAgentContainer) bool {
-		return container.ID == name
-	})
-
-	return f.removeErr
-}
-
 // fakeDevcontainerCLI implements the agentcontainers.DevcontainerCLI
 // interface for testing.
 type fakeDevcontainerCLI struct {
@@ -145,62 +115,6 @@ func (f *fakeDevcontainerCLI) Exec(ctx context.Context, _, _ string, cmd string,
 	return f.execErr
 }

-// newFakeDevcontainerCLI returns a `fakeDevcontainerCLI` with the common
-// channel-based controls initialized, plus a cleanup function.
-func newFakeDevcontainerCLI(t testing.TB, cfg agentcontainers.DevcontainerConfig) (*fakeDevcontainerCLI, func()) {
-	t.Helper()
-
-	cli := &fakeDevcontainerCLI{
-		readConfig:     cfg,
-		execErrC:       make(chan func(cmd string, args ...string) error, 1),
-		readConfigErrC: make(chan func(envs []string) error, 1),
-	}
-
-	var once sync.Once
-	cleanup := func() {
-		once.Do(func() {
-			close(cli.execErrC)
-			close(cli.readConfigErrC)
-		})
-	}
-
-	return cli, cleanup
-}
-
-// requireDevcontainerExec ensures the devcontainer CLI Exec behaves like a
-// running process: it signals started by closing `started`, then blocks until
-// `stop` is closed or ctx is canceled.
-func requireDevcontainerExec(
-	ctx context.Context,
-	t testing.TB,
-	cli *fakeDevcontainerCLI,
-	started chan struct{},
-	stop <-chan struct{},
-) {
-	t.Helper()
-
-	require.NotNil(t, cli, "developer error: devcontainerCLI is nil")
-	require.NotNil(t, started, "developer error: started channel is nil")
-	require.NotNil(t, stop, "developer error: stop channel is nil")
-
-	if cli.execErrC == nil {
-		cli.execErrC = make(chan func(cmd string, args ...string) error, 1)
-		t.Cleanup(func() {
-			close(cli.execErrC)
-		})
-	}
-
-	testutil.RequireSend(ctx, t, cli.execErrC, func(_ string, _ ...string) error {
-		close(started)
-		select {
-		case <-stop:
-			return nil
-		case <-ctx.Done():
-			return ctx.Err()
-		}
-	})
-}
-
 func (f *fakeDevcontainerCLI) ReadConfig(ctx context.Context, _, configPath string, envs []string, _ ...agentcontainers.DevcontainerCLIReadConfigOptions) (agentcontainers.DevcontainerConfig, error) {
 	if f.configMap != nil {
 		if v, found := f.configMap[configPath]; found {
@@ -317,58 +231,6 @@ func (w *fakeWatcher) sendEventWaitNextCalled(ctx context.Context, event fsnotif
 	w.waitNext(ctx)
 }

-// newFakeSubAgentClient returns a `fakeSubAgentClient` with the common
-// channel-based controls initialized, plus a cleanup function.
-func newFakeSubAgentClient(t testing.TB, logger slog.Logger) (*fakeSubAgentClient, func()) {
-	t.Helper()
-
-	sac := &fakeSubAgentClient{
-		logger:     logger,
-		agents:     make(map[uuid.UUID]agentcontainers.SubAgent),
-		createErrC: make(chan error, 1),
-		deleteErrC: make(chan error, 1),
-	}
-
-	var once sync.Once
-	cleanup := func() {
-		once.Do(func() {
-			close(sac.createErrC)
-			close(sac.deleteErrC)
-		})
-	}
-
-	return sac, cleanup
-}
-
-func allowSubAgentCreate(ctx context.Context, t testing.TB, sac *fakeSubAgentClient) {
-	t.Helper()
-	require.NotNil(t, sac, "developer error: subAgentClient is nil")
-	require.NotNil(t, sac.createErrC, "developer error: createErrC is nil")
-	testutil.RequireSend(ctx, t, sac.createErrC, nil)
-}
-
-func allowSubAgentDelete(ctx context.Context, t testing.TB, sac *fakeSubAgentClient) {
-	t.Helper()
-	require.NotNil(t, sac, "developer error: subAgentClient is nil")
-	require.NotNil(t, sac.deleteErrC, "developer error: deleteErrC is nil")
-	testutil.RequireSend(ctx, t, sac.deleteErrC, nil)
-}
-
-func expectSubAgentInjection(
-	mCCLI *acmock.MockContainerCLI,
-	containerID string,
-	arch string,
-	coderBin string,
-) {
-	gomock.InOrder(
-		mCCLI.EXPECT().DetectArchitecture(gomock.Any(), containerID).Return(arch, nil),
-		mCCLI.EXPECT().ExecAs(gomock.Any(), containerID, "root", "mkdir", "-p", "/.coder-agent").Return(nil, nil),
-		mCCLI.EXPECT().Copy(gomock.Any(), containerID, coderBin, "/.coder-agent/coder").Return(nil),
-		mCCLI.EXPECT().ExecAs(gomock.Any(), containerID, "root", "chmod", "0755", "/.coder-agent", "/.coder-agent/coder").Return(nil, nil),
-		mCCLI.EXPECT().ExecAs(gomock.Any(), containerID, "root", "/bin/sh", "-c", "chown $(id -u):$(id -g) /.coder-agent/coder").Return(nil, nil),
-	)
-}
-
 // fakeSubAgentClient implements SubAgentClient for testing purposes.
 type fakeSubAgentClient struct {
 	logger slog.Logger
@@ -1010,7 +872,7 @@ func TestAPI(t *testing.T) {
 					upErr: xerrors.New("devcontainer CLI error"),
 				},
 				wantStatus: []int{http.StatusAccepted, http.StatusConflict},
-				wantBody:   []string{"Devcontainer recreation initiated", "is currently starting and cannot be restarted"},
+				wantBody:   []string{"Devcontainer recreation initiated", "Devcontainer recreation already in progress"},
 			},
 			{
 				name:           "OK",
@@ -1033,7 +895,7 @@ func TestAPI(t *testing.T) {
 				},
 				devcontainerCLI: &fakeDevcontainerCLI{},
 				wantStatus:      []int{http.StatusAccepted, http.StatusConflict},
-				wantBody:        []string{"Devcontainer recreation initiated", "is currently starting and cannot be restarted"},
+				wantBody:        []string{"Devcontainer recreation initiated", "Devcontainer recreation already in progress"},
 			},
 		}

@@ -1173,357 +1035,6 @@ func TestAPI(t *testing.T) {
 		}
 	})

-	t.Run("Delete", func(t *testing.T) {
-		t.Parallel()
-
-		if runtime.GOOS == "windows" {
-			t.Skip("Dev Container tests are not supported on Windows (this test uses mocks but fails due to Windows paths)")
-		}
-
-		devcontainerID1 := uuid.New()
-		workspaceFolder1 := "/workspace/test1"
-		configPath1 := "/workspace/test1/.devcontainer/devcontainer.json"
-
-		// Create a container that represents an existing devcontainer.
-		devContainer1 := codersdk.WorkspaceAgentContainer{
-			ID:           "container-1",
-			FriendlyName: "test-container-1",
-			Running:      true,
-			Labels: map[string]string{
-				agentcontainers.DevcontainerLocalFolderLabel: workspaceFolder1,
-				agentcontainers.DevcontainerConfigFileLabel:  configPath1,
-			},
-		}
-
-		tests := []struct {
-			name                string
-			devcontainerID      string
-			setupDevcontainers  []codersdk.WorkspaceAgentDevcontainer
-			lister              *fakeContainerCLI
-			devcontainerCLI     *fakeDevcontainerCLI
-			wantStatus          int
-			wantBody            string
-			wantSubAgentDeleted bool
-		}{
-			{
-				name:            "Missing devcontainer ID",
-				devcontainerID:  "",
-				lister:          &fakeContainerCLI{},
-				devcontainerCLI: &fakeDevcontainerCLI{},
-				wantStatus:      http.StatusBadRequest,
-				wantBody:        "Missing devcontainer ID",
-			},
-			{
-				name:           "Devcontainer not found",
-				devcontainerID: uuid.NewString(),
-				lister: &fakeContainerCLI{
-					arch: "<none>",
-				},
-				devcontainerCLI: &fakeDevcontainerCLI{},
-				wantStatus:      http.StatusNotFound,
-				wantBody:        "Devcontainer not found",
-			},
-			{
-				name:           "Devcontainer is starting",
-				devcontainerID: devcontainerID1.String(),
-				setupDevcontainers: []codersdk.WorkspaceAgentDevcontainer{
-					{
-						ID:              devcontainerID1,
-						Name:            "test-devcontainer-1",
-						WorkspaceFolder: workspaceFolder1,
-						ConfigPath:      configPath1,
-						Status:          codersdk.WorkspaceAgentDevcontainerStatusStarting,
-						Container:       &devContainer1,
-					},
-				},
-				lister: &fakeContainerCLI{
-					containers: codersdk.WorkspaceAgentListContainersResponse{
-						Containers: []codersdk.WorkspaceAgentContainer{devContainer1},
-					},
-					arch: "<none>",
-				},
-				devcontainerCLI: &fakeDevcontainerCLI{},
-				wantStatus:      http.StatusConflict,
-				wantBody:        "is currently starting and cannot be deleted",
-			},
-			{
-				name:           "Devcontainer is stopping",
-				devcontainerID: devcontainerID1.String(),
-				setupDevcontainers: []codersdk.WorkspaceAgentDevcontainer{
-					{
-						ID:              devcontainerID1,
-						Name:            "test-devcontainer-1",
-						WorkspaceFolder: workspaceFolder1,
-						ConfigPath:      configPath1,
-						Status:          codersdk.WorkspaceAgentDevcontainerStatusDeleting,
-						Container:       &devContainer1,
-					},
-				},
-				lister: &fakeContainerCLI{
-					containers: codersdk.WorkspaceAgentListContainersResponse{
-						Containers: []codersdk.WorkspaceAgentContainer{devContainer1},
-					},
-					arch: "<none>",
-				},
-				devcontainerCLI: &fakeDevcontainerCLI{},
-				wantStatus:      http.StatusConflict,
-				wantBody:        "is currently deleting and cannot be deleted.",
-			},
-			{
-				name:           "Container stop fails",
-				devcontainerID: devcontainerID1.String(),
-				setupDevcontainers: []codersdk.WorkspaceAgentDevcontainer{
-					{
-						ID:              devcontainerID1,
-						Name:            "test-devcontainer-1",
-						WorkspaceFolder: workspaceFolder1,
-						ConfigPath:      configPath1,
-						Status:          codersdk.WorkspaceAgentDevcontainerStatusRunning,
-						Container:       &devContainer1,
-					},
-				},
-				lister: &fakeContainerCLI{
-					containers: codersdk.WorkspaceAgentListContainersResponse{
-						Containers: []codersdk.WorkspaceAgentContainer{devContainer1},
-					},
-					arch:    "<none>",
-					stopErr: xerrors.New("stop error"),
-				},
-				devcontainerCLI: &fakeDevcontainerCLI{},
-				wantStatus:      http.StatusInternalServerError,
-				wantBody:        "An error occurred stopping the container",
-			},
-			{
-				name:           "Container remove fails",
-				devcontainerID: devcontainerID1.String(),
-				setupDevcontainers: []codersdk.WorkspaceAgentDevcontainer{
-					{
-						ID:              devcontainerID1,
-						Name:            "test-devcontainer-1",
-						WorkspaceFolder: workspaceFolder1,
-						ConfigPath:      configPath1,
-						Status:          codersdk.WorkspaceAgentDevcontainerStatusRunning,
-						Container:       &devContainer1,
-					},
-				},
-				lister: &fakeContainerCLI{
-					containers: codersdk.WorkspaceAgentListContainersResponse{
-						Containers: []codersdk.WorkspaceAgentContainer{devContainer1},
-					},
-					arch:      "<none>",
-					removeErr: xerrors.New("remove error"),
-				},
-				devcontainerCLI: &fakeDevcontainerCLI{},
-				wantStatus:      http.StatusInternalServerError,
-				wantBody:        "An error occurred removing the container",
-			},
-			{
-				name:           "OK with container",
-				devcontainerID: devcontainerID1.String(),
-				setupDevcontainers: []codersdk.WorkspaceAgentDevcontainer{
-					{
-						ID:              devcontainerID1,
-						Name:            "test-devcontainer-1",
-						WorkspaceFolder: workspaceFolder1,
-						ConfigPath:      configPath1,
-						Status:          codersdk.WorkspaceAgentDevcontainerStatusRunning,
-						Container:       &devContainer1,
-					},
-				},
-				lister: &fakeContainerCLI{
-					containers: codersdk.WorkspaceAgentListContainersResponse{
-						Containers: []codersdk.WorkspaceAgentContainer{devContainer1},
-					},
-					arch: "<none>",
-				},
-				devcontainerCLI: &fakeDevcontainerCLI{},
-				wantStatus:      http.StatusNoContent,
-				wantBody:        "",
-			},
-			{
-				name:           "OK without container",
-				devcontainerID: devcontainerID1.String(),
-				setupDevcontainers: []codersdk.WorkspaceAgentDevcontainer{
-					{
-						ID:              devcontainerID1,
-						Name:            "test-devcontainer-1",
-						WorkspaceFolder: workspaceFolder1,
-						ConfigPath:      configPath1,
-						Status:          codersdk.WorkspaceAgentDevcontainerStatusStopped,
-						Container:       nil,
-					},
-				},
-				lister: &fakeContainerCLI{
-					arch: "<none>",
-				},
-				devcontainerCLI: &fakeDevcontainerCLI{},
-				wantStatus:      http.StatusNoContent,
-				wantBody:        "",
-			},
-			{
-				name:           "OK with container and subagent",
-				devcontainerID: devcontainerID1.String(),
-				setupDevcontainers: []codersdk.WorkspaceAgentDevcontainer{
-					{
-						ID:              devcontainerID1,
-						Name:            "test-devcontainer-1",
-						WorkspaceFolder: workspaceFolder1,
-						ConfigPath:      configPath1,
-						Status:          codersdk.WorkspaceAgentDevcontainerStatusStopped,
-						Container:       &devContainer1,
-					},
-				},
-				lister: &fakeContainerCLI{
-					containers: codersdk.WorkspaceAgentListContainersResponse{
-						Containers: []codersdk.WorkspaceAgentContainer{devContainer1},
-					},
-					arch: "amd64",
-				},
-				devcontainerCLI: &fakeDevcontainerCLI{
-					readConfig: agentcontainers.DevcontainerConfig{
-						Workspace: agentcontainers.DevcontainerWorkspace{
-							WorkspaceFolder: workspaceFolder1,
-						},
-					},
-				},
-				wantStatus:          http.StatusNoContent,
-				wantBody:            "",
-				wantSubAgentDeleted: true,
-			},
-		}
-
-		for _, tt := range tests {
-			t.Run(tt.name, func(t *testing.T) {
-				t.Parallel()
-
-				var (
-					ctx          = testutil.Context(t, testutil.WaitShort)
-					logger       = slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
-					mClock       = quartz.NewMock(t)
-					withSubAgent = tt.wantSubAgentDeleted
-				)
-
-				mClock.Set(time.Now()).MustWait(ctx)
-				tickerTrap := mClock.Trap().TickerFunc("updaterLoop")
-
-				var (
-					fakeSAC      *fakeSubAgentClient
-					mCCLI        *acmock.MockContainerCLI
-					containerCLI agentcontainers.ContainerCLI
-				)
-				if withSubAgent {
-					var cleanupSAC func()
-					fakeSAC, cleanupSAC = newFakeSubAgentClient(t, logger.Named("fakeSubAgentClient"))
-					defer cleanupSAC()
-
-					mCCLI = acmock.NewMockContainerCLI(gomock.NewController(t))
-					containerCLI = mCCLI
-
-					coderBin, err := os.Executable()
-					require.NoError(t, err)
-					coderBin, err = filepath.EvalSymlinks(coderBin)
-					require.NoError(t, err)
-
-					mCCLI.EXPECT().List(gomock.Any()).Return(codersdk.WorkspaceAgentListContainersResponse{
-						Containers: tt.lister.containers.Containers,
-					}, nil).AnyTimes()
-					expectSubAgentInjection(mCCLI, devContainer1.ID, runtime.GOARCH, coderBin)
-
-					mCCLI.EXPECT().Stop(gomock.Any(), devContainer1.ID).Return(nil).Times(1)
-					mCCLI.EXPECT().Remove(gomock.Any(), devContainer1.ID).Return(nil).Times(1)
-				} else {
-					containerCLI = tt.lister
-				}
-
-				apiOpts := []agentcontainers.Option{
-					agentcontainers.WithClock(mClock),
-					agentcontainers.WithContainerCLI(containerCLI),
-					agentcontainers.WithDevcontainerCLI(tt.devcontainerCLI),
-					agentcontainers.WithWatcher(watcher.NewNoop()),
-					agentcontainers.WithDevcontainers(tt.setupDevcontainers, nil),
-				}
-				if withSubAgent {
-					apiOpts = append(apiOpts,
-						agentcontainers.WithSubAgentClient(fakeSAC),
-						agentcontainers.WithSubAgentURL("test-subagent-url"),
-					)
-				}
-
-				api := agentcontainers.NewAPI(logger, apiOpts...)
-
-				api.Start()
-				defer api.Close()
-
-				r := chi.NewRouter()
-				r.Mount("/", api.Routes())
-
-				var (
-					agentRunningCh chan struct{}
-					stopAgentCh    chan struct{}
-				)
-				if withSubAgent {
-					agentRunningCh = make(chan struct{})
-					stopAgentCh = make(chan struct{})
-					defer close(stopAgentCh)
-
-					allowSubAgentCreate(ctx, t, fakeSAC)
-
-					if tt.devcontainerCLI != nil {
-						requireDevcontainerExec(ctx, t, tt.devcontainerCLI, agentRunningCh, stopAgentCh)
-					}
-				}
-
-				tickerTrap.MustWait(ctx).MustRelease(ctx)
-				tickerTrap.Close()
-
-				if tt.wantSubAgentDeleted {
-					err := api.RefreshContainers(ctx)
-					require.NoError(t, err, "refresh containers should not fail")
-
-					select {
-					case <-agentRunningCh:
-					case <-ctx.Done():
-						t.Fatal("timeout waiting for agent to start")
-					}
-
-					require.Len(t, fakeSAC.created, 1, "subagent should be created")
-					require.Empty(t, fakeSAC.deleted, "no subagent should be deleted yet")
-
-					allowSubAgentDelete(ctx, t, fakeSAC)
-				}
-
-				req := httptest.NewRequest(http.MethodDelete, "/devcontainers/"+tt.devcontainerID+"/", nil).
-					WithContext(ctx)
-				rec := httptest.NewRecorder()
-				r.ServeHTTP(rec, req)
-
-				require.Equal(t, tt.wantStatus, rec.Code, "status code mismatch")
-				if tt.wantBody != "" {
-					assert.Contains(t, rec.Body.String(), tt.wantBody, "response body mismatch")
-				}
-
-				// For successful deletes, verify the devcontainer is removed from the list.
-				if tt.wantStatus == http.StatusNoContent {
-					req = httptest.NewRequest(http.MethodGet, "/", nil).
-						WithContext(ctx)
-					rec = httptest.NewRecorder()
-					r.ServeHTTP(rec, req)
-
-					require.Equal(t, http.StatusOK, rec.Code, "status code mismatch on list")
-					var resp codersdk.WorkspaceAgentListContainersResponse
-					err := json.NewDecoder(rec.Body).Decode(&resp)
-					require.NoError(t, err, "unmarshal response failed")
-					assert.Empty(t, resp.Devcontainers, "devcontainer should be removed after delete")
-
-					if tt.wantSubAgentDeleted {
-						require.Len(t, fakeSAC.deleted, 1, "subagent should be deleted")
-						assert.Equal(t, fakeSAC.created[0].ID, fakeSAC.deleted[0], "correct subagent should be deleted")
-					}
-				}
-			})
-		}
-	})
-
 	t.Run("List devcontainers", func(t *testing.T) {
 		t.Parallel()

@@ -2209,17 +1720,25 @@ func TestAPI(t *testing.T) {
 		}

 		var (
-			ctx                     = testutil.Context(t, testutil.WaitMedium)
-			errTestTermination      = xerrors.New("test termination")
-			logger                  = slogtest.Make(t, &slogtest.Options{IgnoredErrorIs: []error{errTestTermination}}).Leveled(slog.LevelDebug)
-			mClock                  = quartz.NewMock(t)
-			mCCLI                   = acmock.NewMockContainerCLI(gomock.NewController(t))
-			fakeSAC, cleanupSAC     = newFakeSubAgentClient(t, logger.Named("fakeSubAgentClient"))
-			fakeDCCLI, cleanupDCCLI = newFakeDevcontainerCLI(t, agentcontainers.DevcontainerConfig{
-				Workspace: agentcontainers.DevcontainerWorkspace{
-					WorkspaceFolder: "/workspaces/coder",
+			ctx                = testutil.Context(t, testutil.WaitMedium)
+			errTestTermination = xerrors.New("test termination")
+			logger             = slogtest.Make(t, &slogtest.Options{IgnoredErrorIs: []error{errTestTermination}}).Leveled(slog.LevelDebug)
+			mClock             = quartz.NewMock(t)
+			mCCLI              = acmock.NewMockContainerCLI(gomock.NewController(t))
+			fakeSAC            = &fakeSubAgentClient{
+				logger:     logger.Named("fakeSubAgentClient"),
+				createErrC: make(chan error, 1),
+				deleteErrC: make(chan error, 1),
+			}
+			fakeDCCLI = &fakeDevcontainerCLI{
+				readConfig: agentcontainers.DevcontainerConfig{
+					Workspace: agentcontainers.DevcontainerWorkspace{
+						WorkspaceFolder: "/workspaces/coder",
+					},
 				},
-			})
+				execErrC:       make(chan func(cmd string, args ...string) error, 1),
+				readConfigErrC: make(chan func(envs []string) error, 1),
+			}

 			testContainer = codersdk.WorkspaceAgentContainer{
 				ID:           "test-container-id",
@@ -2242,11 +1761,18 @@ func TestAPI(t *testing.T) {
 		mCCLI.EXPECT().List(gomock.Any()).Return(codersdk.WorkspaceAgentListContainersResponse{
 			Containers: []codersdk.WorkspaceAgentContainer{testContainer},
 		}, nil).Times(3) // 1 initial call + 2 updates.
-		expectSubAgentInjection(mCCLI, "test-container-id", runtime.GOARCH, coderBin)
+		gomock.InOrder(
+			mCCLI.EXPECT().DetectArchitecture(gomock.Any(), "test-container-id").Return(runtime.GOARCH, nil),
+			mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "mkdir", "-p", "/.coder-agent").Return(nil, nil),
+			mCCLI.EXPECT().Copy(gomock.Any(), "test-container-id", coderBin, "/.coder-agent/coder").Return(nil),
+			mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "chmod", "0755", "/.coder-agent", "/.coder-agent/coder").Return(nil, nil),
+			mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "/bin/sh", "-c", "chown $(id -u):$(id -g) /.coder-agent/coder").Return(nil, nil),
+		)

 		mClock.Set(time.Now()).MustWait(ctx)
 		tickerTrap := mClock.Trap().TickerFunc("updaterLoop")

+		var closeOnce sync.Once
 		api := agentcontainers.NewAPI(logger,
 			agentcontainers.WithClock(mClock),
 			agentcontainers.WithContainerCLI(mCCLI),
@@ -2257,15 +1783,21 @@ func TestAPI(t *testing.T) {
 			agentcontainers.WithManifestInfo("test-user", "test-workspace", "test-parent-agent", "/parent-agent"),
 		)
 		api.Start()
-		defer func() {
-			cleanupSAC()
-			cleanupDCCLI()
+		apiClose := func() {
+			closeOnce.Do(func() {
+				// Close before api.Close() defer to avoid deadlock after test.
+				close(fakeSAC.createErrC)
+				close(fakeSAC.deleteErrC)
+				close(fakeDCCLI.execErrC)
+				close(fakeDCCLI.readConfigErrC)

-			_ = api.Close()
-		}()
+				_ = api.Close()
+			})
+		}
+		defer apiClose()

 		// Allow initial agent creation and injection to succeed.
-		allowSubAgentCreate(ctx, t, fakeSAC)
+		testutil.RequireSend(ctx, t, fakeSAC.createErrC, nil)
 		testutil.RequireSend(ctx, t, fakeDCCLI.readConfigErrC, func(envs []string) error {
 			assert.Contains(t, envs, "CODER_WORKSPACE_AGENT_NAME=coder")
 			assert.Contains(t, envs, "CODER_WORKSPACE_NAME=test-workspace")
@@ -2318,7 +1850,13 @@ func TestAPI(t *testing.T) {
 		t.Log("Waiting for agent reinjection...")

 		// Expect the agent to be reinjected.
-		expectSubAgentInjection(mCCLI, "test-container-id", runtime.GOARCH, coderBin)
+		gomock.InOrder(
+			mCCLI.EXPECT().DetectArchitecture(gomock.Any(), "test-container-id").Return(runtime.GOARCH, nil),
+			mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "mkdir", "-p", "/.coder-agent").Return(nil, nil),
+			mCCLI.EXPECT().Copy(gomock.Any(), "test-container-id", coderBin, "/.coder-agent/coder").Return(nil),
+			mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "chmod", "0755", "/.coder-agent", "/.coder-agent/coder").Return(nil, nil),
+			mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "/bin/sh", "-c", "chown $(id -u):$(id -g) /.coder-agent/coder").Return(nil, nil),
+		)

 		// Verify that the agent has started.
 		agentStarted := make(chan struct{})
@@ -2427,12 +1965,7 @@ func TestAPI(t *testing.T) {

 		t.Log("Agent deleted and recreated successfully.")

-		// Allow API shutdown to delete the currently active agent record.
-		allowSubAgentDelete(ctx, t, fakeSAC)
-
-		err = api.Close()
-		require.NoError(t, err)
-
+		apiClose()
 		require.Len(t, fakeSAC.created, 2, "API close should not create more agents")
 		require.Len(t, fakeSAC.deleted, 2, "API close should delete the agent")
 		assert.Equal(t, fakeSAC.created[1].ID, fakeSAC.deleted[1], "the second created agent should be deleted on API close")
@@ -3492,8 +3025,12 @@ func TestAPI(t *testing.T) {
 			},
 		}

-		fakeSAC, cleanupSAC := newFakeSubAgentClient(t, slogtest.Make(t, nil).Named("fakeSubAgentClient"))
-		defer cleanupSAC()
+		fakeSAC := &fakeSubAgentClient{
+			logger:     slogtest.Make(t, nil).Named("fakeSubAgentClient"),
+			agents:     make(map[uuid.UUID]agentcontainers.SubAgent),
+			createErrC: make(chan error, 1),
+			deleteErrC: make(chan error, 1),
+		}

 		mClock := quartz.NewMock(t)
 		mClock.Set(startTime)
@@ -3510,7 +3047,9 @@ func TestAPI(t *testing.T) {
 		)
 		api.Start()
 		defer func() {
-			_ = api.Close()
+			close(fakeSAC.createErrC)
+			close(fakeSAC.deleteErrC)
+			api.Close()
 		}()

 		err := api.RefreshContainers(ctx)
@@ -3558,7 +3097,7 @@ func TestAPI(t *testing.T) {
 			return nil
 		}
 		testutil.RequireSend(ctx, t, fDCCLI.execErrC, execSubAgent)
-		allowSubAgentCreate(ctx, t, fakeSAC)
+		testutil.RequireSend(ctx, t, fakeSAC.createErrC, nil)

 		fWatcher.sendEventWaitNextCalled(ctx, fsnotify.Event{
 			Name: configPath,
@@ -3598,7 +3137,7 @@ func TestAPI(t *testing.T) {

 		t.Log("Phase 3: Change back to ignore=true and test sub agent deletion")
 		fDCCLI.readConfig.Configuration.Customizations.Coder.Ignore = true
-		allowSubAgentDelete(ctx, t, fakeSAC)
+		testutil.RequireSend(ctx, t, fakeSAC.deleteErrC, nil)

 		fWatcher.sendEventWaitNextCalled(ctx, fsnotify.Event{
 			Name: configPath,
@@ -17,10 +17,6 @@ type ContainerCLI interface {
 	Copy(ctx context.Context, containerName, src, dst string) error
 	// ExecAs executes a command in a container as a specific user.
 	ExecAs(ctx context.Context, containerName, user string, args ...string) ([]byte, error)
-	// Stop terminates the container
-	Stop(ctx context.Context, containerName string) error
-	// Remove removes the container
-	Remove(ctx context.Context, containerName string) error
 }

 // noopContainerCLI is a ContainerCLI that does nothing.
@@ -39,5 +35,3 @@ func (noopContainerCLI) Copy(_ context.Context, _ string, _ string, _ string) er
 func (noopContainerCLI) ExecAs(_ context.Context, _ string, _ string, _ ...string) ([]byte, error) {
 	return nil, nil
 }
-func (noopContainerCLI) Stop(_ context.Context, _ string) error   { return nil }
-func (noopContainerCLI) Remove(_ context.Context, _ string) error { return nil }
@@ -583,22 +583,6 @@ func (dcli *dockerCLI) ExecAs(ctx context.Context, containerName, uid string, ar
 	return stdout, nil
 }

-func (dcli *dockerCLI) Stop(ctx context.Context, containerName string) error {
-	_, stderr, err := runCmd(ctx, dcli.execer, "docker", "stop", containerName)
-	if err != nil {
-		return xerrors.Errorf("stop %s: %w: %s", containerName, err, stderr)
-	}
-	return nil
-}
-
-func (dcli *dockerCLI) Remove(ctx context.Context, containerName string) error {
-	_, stderr, err := runCmd(ctx, dcli.execer, "docker", "rm", containerName)
-	if err != nil {
-		return xerrors.Errorf("remove %s: %w: %s", containerName, err, stderr)
-	}
-	return nil
-}
-
 // runCmd is a helper function that runs a command with the given
 // arguments and returns the stdout and stderr output.
 func runCmd(ctx context.Context, execer agentexec.Execer, cmd string, args ...string) (stdout, stderr []byte, err error) {
@@ -126,99 +126,3 @@ func TestIntegrationDockerCLI(t *testing.T) {
 		t.Logf("Successfully executed commands in container %s", containerName)
 	})
 }
-
-// TestIntegrationDockerCLIStop tests the Stop method using a real
-// Docker container.
-//
-// Run manually with: CODER_TEST_USE_DOCKER=1 go test ./agent/agentcontainers -run TestIntegrationDockerCLIStop
-//
-//nolint:tparallel,paralleltest // Docker integration tests don't run in parallel to avoid flakiness.
-func TestIntegrationDockerCLIStop(t *testing.T) {
-	if os.Getenv("CODER_TEST_USE_DOCKER") != "1" {
-		t.Skip("Set CODER_TEST_USE_DOCKER=1 to run this test")
-	}
-
-	ctx := testutil.Context(t, testutil.WaitLong)
-
-	pool, err := dockertest.NewPool("")
-	require.NoError(t, err, "Could not connect to docker")
-
-	// Given: A simple busybox container
-	ct, err := pool.RunWithOptions(&dockertest.RunOptions{
-		Repository: "busybox",
-		Tag:        "latest",
-		Cmd:        []string{"sleep", "infinity"},
-	}, func(config *docker.HostConfig) {
-		config.RestartPolicy = docker.RestartPolicy{Name: "no"}
-	})
-	require.NoError(t, err, "Could not start test docker container")
-	t.Logf("Created container %q", ct.Container.Name)
-	t.Cleanup(func() {
-		assert.NoError(t, pool.Purge(ct), "Could not purge resource %q", ct.Container.Name)
-		t.Logf("Purged container %q", ct.Container.Name)
-	})
-
-	// Given: The container is running
-	require.Eventually(t, func() bool {
-		ct, ok := pool.ContainerByName(ct.Container.Name)
-		return ok && ct.Container.State.Running
-	}, testutil.WaitShort, testutil.IntervalSlow, "Container did not start in time")
-
-	dcli := agentcontainers.NewDockerCLI(agentexec.DefaultExecer)
-	containerName := strings.TrimPrefix(ct.Container.Name, "/")
-
-	// When: We attempt to stop the container
-	err = dcli.Stop(ctx, containerName)
-	require.NoError(t, err)
-
-	// Then: We expect the container to be stopped.
-	ct, ok := pool.ContainerByName(ct.Container.Name)
-	require.True(t, ok)
-	require.False(t, ct.Container.State.Running)
-	require.Equal(t, "exited", ct.Container.State.Status)
-}
-
-// TestIntegrationDockerCLIRemove tests the Remove method using a real
-// Docker container.
-//
-// Run manually with: CODER_TEST_USE_DOCKER=1 go test ./agent/agentcontainers -run TestIntegrationDockerCLIRemove
-//
-//nolint:tparallel,paralleltest // Docker integration tests don't run in parallel to avoid flakiness.
-func TestIntegrationDockerCLIRemove(t *testing.T) {
-	if os.Getenv("CODER_TEST_USE_DOCKER") != "1" {
-		t.Skip("Set CODER_TEST_USE_DOCKER=1 to run this test")
-	}
-
-	ctx := testutil.Context(t, testutil.WaitLong)
-
-	pool, err := dockertest.NewPool("")
-	require.NoError(t, err, "Could not connect to docker")
-
-	// Given: A simple busybox container that exits immediately.
-	ct, err := pool.RunWithOptions(&dockertest.RunOptions{
-		Repository: "busybox",
-		Tag:        "latest",
-		Cmd:        []string{"true"},
-	}, func(config *docker.HostConfig) {
-		config.RestartPolicy = docker.RestartPolicy{Name: "no"}
-	})
-	require.NoError(t, err, "Could not start test docker container")
-	t.Logf("Created container %q", ct.Container.Name)
-	containerName := strings.TrimPrefix(ct.Container.Name, "/")
-
-	// Wait for the container to exit.
-	require.Eventually(t, func() bool {
-		ct, ok := pool.ContainerByName(ct.Container.Name)
-		return ok && !ct.Container.State.Running
-	}, testutil.WaitShort, testutil.IntervalSlow, "Container did not stop in time")
-
-	dcli := agentcontainers.NewDockerCLI(agentexec.DefaultExecer)
-
-	// When: We attempt to remove the container.
-	err = dcli.Remove(ctx, containerName)
-	require.NoError(t, err)
-
-	// Then: We expect the container to be removed.
-	_, ok := pool.ContainerByName(ct.Container.Name)
-	require.False(t, ok, "Container should be removed")
-}
@@ -10,10 +10,11 @@ package dcspec

 import (
 	"bytes"
-	"encoding/json"
 	"errors"
 )

+import "encoding/json"
+
 func UnmarshalDevContainer(data []byte) (DevContainer, error) {
 	var r DevContainer
 	err := json.Unmarshal(data, &r)
@@ -61,7 +61,7 @@ fi
 exec 3>&-

 # Format the generated code.
-"${PROJECT_ROOT}/scripts/format_go_file.sh" "${TMPDIR}/${DEST_FILENAME}"
+go run mvdan.cc/gofumpt@v0.8.0 -w -l "${TMPDIR}/${DEST_FILENAME}"

 # Add a header so that Go recognizes this as a generated file.
 if grep -q -- "\[-i extension\]" < <(sed -h 2>&1); then
@@ -7,7 +7,7 @@ import (

 	"github.com/google/uuid"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/codersdk"
 )

@@ -13,7 +13,7 @@ import (

 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/codersdk"
 )
@@ -21,8 +21,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/slogtest"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
 	"github.com/coder/coder/v2/agent/agentcontainers"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/codersdk"
@@ -7,7 +7,7 @@ import (
 	"runtime"
 	"strings"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/agent/usershell"
 	"github.com/coder/coder/v2/pty"
@@ -14,7 +14,7 @@ import (
 	"github.com/spf13/afero"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 const (
@@ -7,7 +7,8 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
+
 	agentproto "github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/codersdk"
 )
@@ -146,12 +147,12 @@ type SubAgentClient interface {
 // agent API client.
 type subAgentAPIClient struct {
 	logger slog.Logger
-	api    agentproto.DRPCAgentClient27
+	api    agentproto.DRPCAgentClient26
 }

 var _ SubAgentClient = (*subAgentAPIClient)(nil)

-func NewSubAgentClientFromAPI(logger slog.Logger, agentAPI agentproto.DRPCAgentClient27) SubAgentClient {
+func NewSubAgentClientFromAPI(logger slog.Logger, agentAPI agentproto.DRPCAgentClient26) SubAgentClient {
 	if agentAPI == nil {
 		panic("developer error: agentAPI cannot be nil")
 	}
@@ -81,7 +81,7 @@ func TestSubAgentClient_CreateWithDisplayApps(t *testing.T) {

 				agentAPI := agenttest.NewClient(t, logger, uuid.New(), agentsdk.Manifest{}, statsCh, tailnet.NewCoordinator(logger))

-				agentClient, _, err := agentAPI.ConnectRPC27(ctx)
+				agentClient, _, err := agentAPI.ConnectRPC26(ctx)
 				require.NoError(t, err)

 				subAgentClient := agentcontainers.NewSubAgentClientFromAPI(logger, agentClient)
@@ -245,7 +245,7 @@ func TestSubAgentClient_CreateWithDisplayApps(t *testing.T) {

 				agentAPI := agenttest.NewClient(t, logger, uuid.New(), agentsdk.Manifest{}, statsCh, tailnet.NewCoordinator(logger))

-				agentClient, _, err := agentAPI.ConnectRPC27(ctx)
+				agentClient, _, err := agentAPI.ConnectRPC26(ctx)
 				require.NoError(t, err)

 				subAgentClient := agentcontainers.NewSubAgentClientFromAPI(logger, agentClient)
@@ -20,7 +20,8 @@ import (
 	"golang.org/x/xerrors"
 	"google.golang.org/protobuf/types/known/timestamppb"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
+
 	"github.com/coder/coder/v2/agent/agentssh"
 	"github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
@@ -7,7 +7,7 @@ import (
 	"os/exec"
 	"syscall"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 func cmdSysProcAttr() *syscall.SysProcAttr {
@@ -6,7 +6,7 @@ import (
 	"os/exec"
 	"syscall"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 func cmdSysProcAttr() *syscall.SysProcAttr {
@@ -10,7 +10,7 @@ import (
 	"storj.io/drpc/drpcmux"
 	"storj.io/drpc/drpcserver"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentsocket/proto"
 	"github.com/coder/coder/v2/agent/unit"
 	"github.com/coder/coder/v2/codersdk/drpcsdk"
@@ -10,7 +10,7 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/require"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent"
 	"github.com/coder/coder/v2/agent/agentsocket"
 	"github.com/coder/coder/v2/agent/agenttest"
@@ -6,7 +6,7 @@ import (

 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentsocket/proto"
 	"github.com/coder/coder/v2/agent/unit"
 )
@@ -2,18 +2,47 @@ package agentsocket_test

 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"os"
 	"path/filepath"
 	"runtime"
 	"testing"

+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentsocket"
 	"github.com/coder/coder/v2/agent/unit"
 	"github.com/coder/coder/v2/testutil"
 )

+// tempDirUnixSocket returns a temporary directory that can safely hold unix
+// sockets (probably).
+//
+// During tests on darwin we hit the max path length limit for unix sockets
+// pretty easily in the default location, so this function uses /tmp instead to
+// get shorter paths. To keep paths short, we use a hash of the test name
+// instead of the full test name.
+func tempDirUnixSocket(t *testing.T) string {
+	t.Helper()
+	if runtime.GOOS == "darwin" {
+		// Use a short hash of the test name to keep the path under 104 chars
+		hash := sha256.Sum256([]byte(t.Name()))
+		hashStr := hex.EncodeToString(hash[:])[:8] // Use first 8 chars of hash
+		dir, err := os.MkdirTemp("/tmp", fmt.Sprintf("c-%s-", hashStr))
+		require.NoError(t, err, "create temp dir for unix socket test")
+		t.Cleanup(func() {
+			err := os.RemoveAll(dir)
+			assert.NoError(t, err, "remove temp dir", dir)
+		})
+		return dir
+	}
+	return t.TempDir()
+}
+
 // newSocketClient creates a DRPC client connected to the Unix socket at the given path.
 func newSocketClient(ctx context.Context, t *testing.T, socketPath string) *agentsocket.Client {
 	t.Helper()
@@ -37,7 +66,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 	t.Run("Ping", func(t *testing.T) {
 		t.Parallel()

-		socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+		socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 		ctx := testutil.Context(t, testutil.WaitShort)
 		server, err := agentsocket.NewServer(
 			slog.Make().Leveled(slog.LevelDebug),
@@ -57,7 +86,7 @@ func TestDRPCAgentSocketService(t *testing.T) {

 		t.Run("NewUnit", func(t *testing.T) {
 			t.Parallel()
-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -79,7 +108,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("UnitAlreadyStarted", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -109,7 +138,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("UnitAlreadyCompleted", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -148,7 +177,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("UnitNotReady", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -178,7 +207,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("NewUnits", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -203,7 +232,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("DependencyAlreadyRegistered", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -238,7 +267,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("DependencyAddedAfterDependentStarted", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -280,7 +309,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("UnregisteredUnit", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -299,7 +328,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("UnitNotReady", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -323,7 +352,7 @@ func TestDRPCAgentSocketService(t *testing.T) {
 		t.Run("UnitReady", func(t *testing.T) {
 			t.Parallel()

-			socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "test.sock")
+			socketPath := filepath.Join(tempDirUnixSocket(t), "test.sock")
 			ctx := testutil.Context(t, testutil.WaitShort)
 			server, err := agentsocket.NewServer(
 				slog.Make().Leveled(slog.LevelDebug),
@@ -27,7 +27,8 @@ import (
 	gossh "golang.org/x/crypto/ssh"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
+
 	"github.com/coder/coder/v2/agent/agentcontainers"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/agent/agentrsa"
@@ -828,19 +829,13 @@ func (s *Server) sftpHandler(logger slog.Logger, session ssh.Session) error {
 	session.DisablePTYEmulation()

 	var opts []sftp.ServerOption
-	// Change current working directory to the configured
-	// directory (or home directory if not set) so that SFTP
-	// connections land there.
-	dir := s.config.WorkingDirectory()
-	if dir == "" {
-		var err error
-		dir, err = userHomeDir()
-		if err != nil {
-			logger.Warn(ctx, "get sftp working directory failed, unable to get home dir", slog.Error(err))
-		}
-	}
-	if dir != "" {
-		opts = append(opts, sftp.WithServerWorkingDirectory(dir))
+	// Change current working directory to the users home
+	// directory so that SFTP connections land there.
+	homedir, err := userHomeDir()
+	if err != nil {
+		logger.Warn(ctx, "get sftp working directory failed, unable to get home dir", slog.Error(err))
+	} else {
+		opts = append(opts, sftp.WithServerWorkingDirectory(homedir))
 	}

 	server, err := sftp.NewServer(session, opts...)
@@ -24,8 +24,9 @@ import (
 	"go.uber.org/goleak"
 	"golang.org/x/crypto/ssh"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/slogtest"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/agent/agentssh"
 	"github.com/coder/coder/v2/pty/ptytest"
@@ -7,7 +7,7 @@ import (
 	"os"
 	"syscall"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 func cmdSysProcAttr() *syscall.SysProcAttr {
@@ -5,7 +5,7 @@ import (
 	"os"
 	"syscall"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 func cmdSysProcAttr() *syscall.SysProcAttr {
@@ -15,7 +15,7 @@ import (
 	gossh "golang.org/x/crypto/ssh"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 // streamLocalForwardPayload describes the extra data sent in a
@@ -10,7 +10,7 @@ import (
 	"go.uber.org/atomic"
 	gossh "golang.org/x/crypto/ssh"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 // localForwardChannelData is copied from the ssh package.
@@ -21,7 +21,7 @@ import (
 	gossh "golang.org/x/crypto/ssh"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 const (
@@ -21,7 +21,7 @@ import (
 	"storj.io/drpc/drpcserver"
 	"tailscale.com/tailcfg"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	agentproto "github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"
@@ -124,8 +124,8 @@ func (c *Client) Close() {
 	c.derpMapOnce.Do(func() { close(c.derpMapUpdates) })
 }

-func (c *Client) ConnectRPC27(ctx context.Context) (
-	agentproto.DRPCAgentClient27, proto.DRPCTailnetClient27, error,
+func (c *Client) ConnectRPC26(ctx context.Context) (
+	agentproto.DRPCAgentClient26, proto.DRPCTailnetClient26, error,
 ) {
 	conn, lis := drpcsdk.MemTransportPipe()
 	c.LastWorkspaceAgent = func() {
@@ -405,10 +405,6 @@ func (f *FakeAgentAPI) ReportConnection(_ context.Context, req *agentproto.Repor
 	return &emptypb.Empty{}, nil
 }

-func (*FakeAgentAPI) ReportBoundaryLogs(_ context.Context, _ *agentproto.ReportBoundaryLogsRequest) (*agentproto.ReportBoundaryLogsResponse, error) {
-	return &agentproto.ReportBoundaryLogsResponse{}, nil
-}
-
 func (f *FakeAgentAPI) GetConnectionReports() []*agentproto.ReportConnectionRequest {
 	f.Lock()
 	defer f.Unlock()
@@ -9,7 +9,7 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"
 	"github.com/coder/quartz"
@@ -1,164 +0,0 @@
-//go:build linux || darwin
-
-package agent_test
-
-import (
-	"context"
-	"net"
-	"path/filepath"
-	"sync"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"cdr.dev/slog/v3"
-	"github.com/coder/coder/v2/agent/boundarylogproxy"
-	"github.com/coder/coder/v2/agent/boundarylogproxy/codec"
-	agentproto "github.com/coder/coder/v2/agent/proto"
-	"github.com/coder/coder/v2/coderd/agentapi"
-	"github.com/coder/coder/v2/testutil"
-)
-
-// logSink captures structured log entries for testing.
-type logSink struct {
-	mu      sync.Mutex
-	entries []slog.SinkEntry
-}
-
-func (s *logSink) LogEntry(_ context.Context, e slog.SinkEntry) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.entries = append(s.entries, e)
-}
-
-func (*logSink) Sync() {}
-
-func (s *logSink) getEntries() []slog.SinkEntry {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return append([]slog.SinkEntry{}, s.entries...)
-}
-
-// getField returns the value of a field by name from a slog.Map.
-func getField(fields slog.Map, name string) interface{} {
-	for _, f := range fields {
-		if f.Name == name {
-			return f.Value
-		}
-	}
-	return nil
-}
-
-func sendBoundaryLogsRequest(t *testing.T, conn net.Conn, req *agentproto.ReportBoundaryLogsRequest) {
-	t.Helper()
-
-	data, err := proto.Marshal(req)
-	require.NoError(t, err)
-
-	err = codec.WriteFrame(conn, codec.TagV1, data)
-	require.NoError(t, err)
-}
-
-// TestBoundaryLogs_EndToEnd is an end-to-end test that sends a protobuf
-// message over the agent's unix socket (as boundary would) and verifies
-// it is ultimately logged by coderd with the correct structured fields.
-func TestBoundaryLogs_EndToEnd(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	sink := &logSink{}
-	logger := slog.Make(sink)
-	workspaceID := uuid.New()
-	reporter := &agentapi.BoundaryLogsAPI{
-		Log:         logger,
-		WorkspaceID: workspaceID,
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(ctx, reporter)
-	}()
-
-	conn, err := net.Dial("unix", socketPath)
-	require.NoError(t, err)
-	defer conn.Close()
-
-	// Allowed HTTP request.
-	req := &agentproto.ReportBoundaryLogsRequest{
-		Logs: []*agentproto.BoundaryLog{
-			{
-				Allowed: true,
-				Time:    timestamppb.Now(),
-				Resource: &agentproto.BoundaryLog_HttpRequest_{
-					HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-						Method:      "GET",
-						Url:         "https://example.com/allowed",
-						MatchedRule: "*.example.com",
-					},
-				},
-			},
-		},
-	}
-	sendBoundaryLogsRequest(t, conn, req)
-
-	require.Eventually(t, func() bool {
-		return len(sink.getEntries()) >= 1
-	}, testutil.WaitShort, testutil.IntervalFast)
-
-	entries := sink.getEntries()
-	require.Len(t, entries, 1)
-	entry := entries[0]
-	require.Equal(t, slog.LevelInfo, entry.Level)
-	require.Equal(t, "boundary_request", entry.Message)
-	require.Equal(t, "allow", getField(entry.Fields, "decision"))
-	require.Equal(t, workspaceID.String(), getField(entry.Fields, "workspace_id"))
-	require.Equal(t, "GET", getField(entry.Fields, "http_method"))
-	require.Equal(t, "https://example.com/allowed", getField(entry.Fields, "http_url"))
-	require.Equal(t, "*.example.com", getField(entry.Fields, "matched_rule"))
-
-	// Denied HTTP request.
-	req2 := &agentproto.ReportBoundaryLogsRequest{
-		Logs: []*agentproto.BoundaryLog{
-			{
-				Allowed: false,
-				Time:    timestamppb.Now(),
-				Resource: &agentproto.BoundaryLog_HttpRequest_{
-					HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-						Method: "POST",
-						Url:    "https://blocked.com/denied",
-					},
-				},
-			},
-		},
-	}
-	sendBoundaryLogsRequest(t, conn, req2)
-
-	require.Eventually(t, func() bool {
-		return len(sink.getEntries()) >= 2
-	}, testutil.WaitShort, testutil.IntervalFast)
-
-	entries = sink.getEntries()
-	entry = entries[1]
-	require.Len(t, entries, 2)
-	require.Equal(t, slog.LevelInfo, entry.Level)
-	require.Equal(t, "boundary_request", entry.Message)
-	require.Equal(t, "deny", getField(entry.Fields, "decision"))
-	require.Equal(t, workspaceID.String(), getField(entry.Fields, "workspace_id"))
-	require.Equal(t, "POST", getField(entry.Fields, "http_method"))
-	require.Equal(t, "https://blocked.com/denied", getField(entry.Fields, "http_url"))
-	require.Equal(t, nil, getField(entry.Fields, "matched_rule"))
-
-	cancel()
-	<-forwarderDone
-}
@@ -1,127 +0,0 @@
-// Package codec implements the wire format for agent <-> boundary communication.
-//
-// Wire Format:
-//   - 8 bits: big-endian tag
-//   - 24 bits: big-endian length of the protobuf data (bit usage depends on tag)
-//   - length bytes: encoded protobuf data
-//
-// Note that while there are 24 bits available for the length, the actual maximum
-// length depends on the tag. For TagV1, only 15 bits are used (MaxMessageSizeV1).
-package codec
-
-import (
-	"encoding/binary"
-	"io"
-
-	"golang.org/x/xerrors"
-)
-
-type Tag uint8
-
-const (
-	// TagV1 identifies the first revision of the protocol. This version has a maximum
-	// data length of MaxMessageSizeV1.
-	TagV1 Tag = 1
-)
-
-const (
-	// DataLength is the number of bits used for the length of encoded protobuf data.
-	DataLength = 24
-
-	// tagLength is the number of bits used for the tag.
-	tagLength = 8
-
-	// MaxMessageSizeV1 is the maximum size of the encoded protobuf messages sent
-	// over the wire for the TagV1 tag. While the wire format allows 24 bits for
-	// length, TagV1 only uses 15 bits.
-	MaxMessageSizeV1 uint32 = 1 << 15
-)
-
-var (
-	// ErrMessageTooLarge is returned when the message exceeds the maximum size
-	// allowed for the tag.
-	ErrMessageTooLarge = xerrors.New("message too large")
-	// ErrUnsupportedTag is returned when an unrecognized tag is encountered.
-	ErrUnsupportedTag = xerrors.New("unsupported tag")
-)
-
-// WriteFrame writes a framed message with the given tag and data. The data
-// must not exceed 2^DataLength in length.
-func WriteFrame(w io.Writer, tag Tag, data []byte) error {
-	var maxSize uint32
-	switch tag {
-	case TagV1:
-		maxSize = MaxMessageSizeV1
-	default:
-		return xerrors.Errorf("%w: %d", ErrUnsupportedTag, tag)
-	}
-
-	if len(data) > int(maxSize) {
-		return xerrors.Errorf("%w for tag %d: %d > %d", ErrMessageTooLarge, tag, len(data), maxSize)
-	}
-
-	var header uint32
-	//nolint:gosec // The length check above ensures there's no overflow.
-	header |= uint32(len(data))
-	header |= uint32(tag) << DataLength
-
-	if err := binary.Write(w, binary.BigEndian, header); err != nil {
-		return xerrors.Errorf("write header error: %w", err)
-	}
-	if _, err := w.Write(data); err != nil {
-		return xerrors.Errorf("write data error: %w", err)
-	}
-
-	return nil
-}
-
-// ReadFrame reads a framed message, returning the decoded tag and data. If the
-// message size exceeds MaxMessageSizeV1, ErrMessageTooLarge is returned. The
-// provided buf is used if it has sufficient capacity; otherwise a new buffer is
-// allocated. To reuse the buffer across calls, pass in the returned data slice:
-//
-//	buf := make([]byte, initialSize)
-//	for {
-//	    _, buf, _ = ReadFrame(r, buf)
-//	}
-func ReadFrame(r io.Reader, buf []byte) (Tag, []byte, error) {
-	var header uint32
-	if err := binary.Read(r, binary.BigEndian, &header); err != nil {
-		return 0, nil, xerrors.Errorf("read header error: %w", err)
-	}
-
-	const lengthMask = (1 << DataLength) - 1
-	length := header & lengthMask
-	const tagMask = (1 << tagLength) - 1 // 0xFF
-	shifted := (header >> DataLength) & tagMask
-	if shifted > tagMask {
-		// This is really only here to satisfy the gosec linter. We know from above that
-		// shifted <= tagMask.
-		return 0, nil, xerrors.Errorf("invalid tag: %d", shifted)
-	}
-	tag := Tag(shifted)
-
-	var maxSize uint32
-	switch tag {
-	case TagV1:
-		maxSize = MaxMessageSizeV1
-	default:
-		return 0, nil, xerrors.Errorf("%w: %d", ErrUnsupportedTag, tag)
-	}
-
-	if length > maxSize {
-		return 0, nil, ErrMessageTooLarge
-	}
-
-	if cap(buf) < int(length) {
-		buf = make([]byte, length)
-	} else {
-		buf = buf[:length:cap(buf)]
-	}
-
-	if _, err := io.ReadFull(r, buf[:length]); err != nil {
-		return 0, nil, xerrors.Errorf("read full error: %w", err)
-	}
-
-	return tag, buf[:length], nil
-}
@@ -1,145 +0,0 @@
-package codec_test
-
-import (
-	"bytes"
-	"encoding/binary"
-	"io"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/coder/coder/v2/agent/boundarylogproxy/codec"
-)
-
-func TestRoundTrip(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		tag  codec.Tag
-		data []byte
-	}{
-		{
-			name: "empty data",
-			tag:  codec.TagV1,
-			data: []byte{},
-		},
-		{
-			name: "simple data",
-			tag:  codec.TagV1,
-			data: []byte("hello world"),
-		},
-		{
-			name: "binary data",
-			tag:  codec.TagV1,
-			data: []byte{0x00, 0x01, 0x02, 0xff, 0xfe},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			var buf bytes.Buffer
-			err := codec.WriteFrame(&buf, tt.tag, tt.data)
-			require.NoError(t, err)
-
-			readBuf := make([]byte, codec.MaxMessageSizeV1)
-			tag, data, err := codec.ReadFrame(&buf, readBuf)
-			require.NoError(t, err)
-			require.Equal(t, tt.tag, tag)
-			require.Equal(t, tt.data, data)
-		})
-	}
-}
-
-func TestReadFrameTooLarge(t *testing.T) {
-	t.Parallel()
-
-	// Hand construct a header that indicates the message size exceeds the maximum
-	// message size for codec.TagV1 by one. We just write the header to buf because
-	// we expect codec.ReadFrame to bail out when reading the invalid length.
-	header := uint32(codec.TagV1)<<codec.DataLength | (codec.MaxMessageSizeV1 + 1)
-	data := make([]byte, 4)
-	binary.BigEndian.PutUint32(data, header)
-
-	var buf bytes.Buffer
-	_, err := buf.Write(data)
-	require.NoError(t, err)
-
-	readBuf := make([]byte, 1)
-	_, _, err = codec.ReadFrame(&buf, readBuf)
-	require.ErrorIs(t, err, codec.ErrMessageTooLarge)
-}
-
-func TestReadFrameEmptyReader(t *testing.T) {
-	t.Parallel()
-
-	var buf bytes.Buffer
-	readBuf := make([]byte, codec.MaxMessageSizeV1)
-	_, _, err := codec.ReadFrame(&buf, readBuf)
-	require.ErrorIs(t, err, io.EOF)
-}
-
-func TestReadFrameInvalidTag(t *testing.T) {
-	t.Parallel()
-
-	// Hand construct a header that indicates a tag we don't know about. We just
-	// write the header to buf because we expect codec.ReadFrame to bail out when
-	// reading the invalid tag.
-	const (
-		dataLength uint32 = 10
-		bogusTag   uint32 = 2
-	)
-	header := bogusTag<<codec.DataLength | dataLength
-	data := make([]byte, 4)
-	binary.BigEndian.PutUint32(data, header)
-
-	var buf bytes.Buffer
-	_, err := buf.Write(data)
-	require.NoError(t, err)
-
-	readBuf := make([]byte, 1)
-	_, _, err = codec.ReadFrame(&buf, readBuf)
-	require.ErrorIs(t, err, codec.ErrUnsupportedTag)
-}
-
-func TestReadFrameAllocatesWhenNeeded(t *testing.T) {
-	t.Parallel()
-
-	var buf bytes.Buffer
-	data := []byte("this message is longer than the buffer")
-	err := codec.WriteFrame(&buf, codec.TagV1, data)
-	require.NoError(t, err)
-
-	// Buffer with insufficient capacity triggers allocation.
-	readBuf := make([]byte, 4)
-	tag, got, err := codec.ReadFrame(&buf, readBuf)
-	require.NoError(t, err)
-	require.Equal(t, codec.TagV1, tag)
-	require.Equal(t, data, got)
-}
-
-func TestWriteFrameDataSize(t *testing.T) {
-	t.Parallel()
-
-	var buf bytes.Buffer
-	data := make([]byte, codec.MaxMessageSizeV1)
-	err := codec.WriteFrame(&buf, codec.TagV1, data)
-	require.NoError(t, err)
-
-	//nolint: makezero // This intentionally increases the slice length.
-	data = append(data, 0) // One byte over the maximum
-	err = codec.WriteFrame(&buf, codec.TagV1, data)
-	require.ErrorIs(t, err, codec.ErrMessageTooLarge)
-}
-
-func TestWriteFrameInvalidTag(t *testing.T) {
-	t.Parallel()
-
-	var buf bytes.Buffer
-	data := make([]byte, 1)
-	const bogusTag = 2
-	err := codec.WriteFrame(&buf, codec.Tag(bogusTag), data)
-	require.ErrorIs(t, err, codec.ErrUnsupportedTag)
-}
@@ -1,205 +0,0 @@
-// Package boundarylogproxy provides a Unix socket server that receives boundary
-// audit logs and forwards them to coderd via the agent API.
-package boundarylogproxy
-
-import (
-	"context"
-	"errors"
-	"io"
-	"net"
-	"os"
-	"path/filepath"
-	"sync"
-
-	"golang.org/x/xerrors"
-	"google.golang.org/protobuf/proto"
-
-	"cdr.dev/slog/v3"
-	"github.com/coder/coder/v2/agent/boundarylogproxy/codec"
-	agentproto "github.com/coder/coder/v2/agent/proto"
-)
-
-const (
-	// logBufferSize is the size of the channel buffer for incoming log requests
-	// from workspaces. This buffer size is intended to handle short bursts of workspaces
-	// forwarding batches of logs in parallel.
-	logBufferSize = 100
-)
-
-// DefaultSocketPath returns the default path for the boundary audit log socket.
-func DefaultSocketPath() string {
-	return filepath.Join(os.TempDir(), "boundary-audit.sock")
-}
-
-// Reporter reports boundary logs from workspaces.
-type Reporter interface {
-	ReportBoundaryLogs(ctx context.Context, req *agentproto.ReportBoundaryLogsRequest) (*agentproto.ReportBoundaryLogsResponse, error)
-}
-
-// Server listens on a Unix socket for boundary log messages and buffers them
-// for forwarding to coderd. The socket server and the forwarder are decoupled:
-// - Start() creates the socket and accepts a connection from boundary
-// - RunForwarder() drains the buffer and sends logs to coderd via AgentAPI
-type Server struct {
-	logger     slog.Logger
-	socketPath string
-
-	listener net.Listener
-	cancel   context.CancelFunc
-	wg       sync.WaitGroup
-
-	// logs buffers incoming log requests for the forwarder to drain.
-	logs chan *agentproto.ReportBoundaryLogsRequest
-}
-
-// NewServer creates a new boundary log proxy server.
-func NewServer(logger slog.Logger, socketPath string) *Server {
-	return &Server{
-		logger:     logger.Named("boundary-log-proxy"),
-		socketPath: socketPath,
-		logs:       make(chan *agentproto.ReportBoundaryLogsRequest, logBufferSize),
-	}
-}
-
-// Start begins listening for connections on the Unix socket, and handles new
-// connections in a separate goroutine. Incoming logs from connections are
-// buffered until RunForwarder drains them.
-func (s *Server) Start() error {
-	if err := os.Remove(s.socketPath); err != nil && !os.IsNotExist(err) {
-		return xerrors.Errorf("remove existing socket: %w", err)
-	}
-
-	listener, err := net.Listen("unix", s.socketPath)
-	if err != nil {
-		return xerrors.Errorf("listen on socket: %w", err)
-	}
-
-	s.listener = listener
-	ctx, cancel := context.WithCancel(context.Background())
-	s.cancel = cancel
-
-	s.wg.Add(1)
-	go s.acceptLoop(ctx)
-
-	s.logger.Info(ctx, "boundary log proxy started", slog.F("socket_path", s.socketPath))
-	return nil
-}
-
-// RunForwarder drains the log buffer and forwards logs to coderd.
-// It blocks until ctx is canceled.
-func (s *Server) RunForwarder(ctx context.Context, sender Reporter) error {
-	s.logger.Debug(ctx, "boundary log forwarder started")
-
-	for {
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		case req := <-s.logs:
-			_, err := sender.ReportBoundaryLogs(ctx, req)
-			if err != nil {
-				s.logger.Warn(ctx, "failed to forward boundary logs",
-					slog.Error(err),
-					slog.F("log_count", len(req.Logs)))
-				// Continue forwarding other logs. The current batch is lost,
-				// but the socket stays alive.
-			}
-		}
-	}
-}
-
-func (s *Server) acceptLoop(ctx context.Context) {
-	defer s.wg.Done()
-
-	for {
-		conn, err := s.listener.Accept()
-		if err != nil {
-			if ctx.Err() != nil {
-				s.logger.Warn(ctx, "accept loop terminated", slog.Error(ctx.Err()))
-				return
-			}
-			s.logger.Warn(ctx, "socket accept error", slog.Error(err))
-			continue
-		}
-
-		s.wg.Add(1)
-		go s.handleConnection(ctx, conn)
-	}
-}
-
-func (s *Server) handleConnection(ctx context.Context, conn net.Conn) {
-	defer s.wg.Done()
-
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	s.wg.Add(1)
-	go func() {
-		defer s.wg.Done()
-		<-ctx.Done()
-		_ = conn.Close()
-	}()
-
-	// This is intended to be a sane starting point for the read buffer size. It may be
-	// grown by codec.ReadFrame if necessary.
-	const initBufSize = 1 << 10
-	buf := make([]byte, initBufSize)
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		default:
-		}
-
-		var (
-			tag codec.Tag
-			err error
-		)
-		tag, buf, err = codec.ReadFrame(conn, buf)
-		switch {
-		case errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed):
-			return
-		case err != nil:
-			s.logger.Warn(ctx, "read frame error", slog.Error(err))
-			return
-		}
-
-		if tag != codec.TagV1 {
-			s.logger.Warn(ctx, "invalid tag value", slog.F("tag", tag))
-			return
-		}
-
-		var req agentproto.ReportBoundaryLogsRequest
-		if err := proto.Unmarshal(buf, &req); err != nil {
-			s.logger.Warn(ctx, "proto unmarshal error", slog.Error(err))
-			continue
-		}
-
-		select {
-		case s.logs <- &req:
-		default:
-			s.logger.Warn(ctx, "dropping boundary logs, buffer full",
-				slog.F("log_count", len(req.Logs)))
-		}
-	}
-}
-
-// Close stops the server and blocks until resources have been cleaned up.
-// It must be called after Start.
-func (s *Server) Close() error {
-	if s.cancel != nil {
-		s.cancel()
-	}
-
-	if s.listener != nil {
-		_ = s.listener.Close()
-	}
-
-	s.wg.Wait()
-
-	err := os.Remove(s.socketPath)
-	if err != nil && !errors.Is(err, os.ErrNotExist) {
-		return err
-	}
-	return nil
-}
@@ -1,578 +0,0 @@
-//go:build linux || darwin
-
-package boundarylogproxy_test
-
-import (
-	"context"
-	"encoding/binary"
-	"net"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/coder/coder/v2/agent/boundarylogproxy"
-	"github.com/coder/coder/v2/agent/boundarylogproxy/codec"
-	agentproto "github.com/coder/coder/v2/agent/proto"
-	"github.com/coder/coder/v2/testutil"
-)
-
-// sendMessage writes a framed protobuf message to the connection.
-func sendMessage(t *testing.T, conn net.Conn, req *agentproto.ReportBoundaryLogsRequest) {
-	t.Helper()
-
-	data, err := proto.Marshal(req)
-	if err != nil {
-		//nolint:gocritic // In tests we're not worried about conn being nil.
-		t.Errorf("%s marshal req: %s", conn.LocalAddr().String(), err)
-	}
-
-	err = codec.WriteFrame(conn, codec.TagV1, data)
-	if err != nil {
-		//nolint:gocritic // In tests we're not worried about conn being nil.
-		t.Errorf("%s write frame: %s", conn.LocalAddr().String(), err)
-	}
-}
-
-// fakeReporter implements boundarylogproxy.Reporter for testing.
-type fakeReporter struct {
-	mu      sync.Mutex
-	logs    []*agentproto.ReportBoundaryLogsRequest
-	err     error
-	errOnce bool // only error once, then succeed
-
-	// reportCb is called when a ReportBoundaryLogsRequest is processed. It must not
-	// block.
-	reportCb func()
-}
-
-func (f *fakeReporter) ReportBoundaryLogs(_ context.Context, req *agentproto.ReportBoundaryLogsRequest) (*agentproto.ReportBoundaryLogsResponse, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if f.reportCb != nil {
-		f.reportCb()
-	}
-
-	if f.err != nil {
-		if f.errOnce {
-			err := f.err
-			f.err = nil
-			return nil, err
-		}
-		return nil, f.err
-	}
-	f.logs = append(f.logs, req)
-	return &agentproto.ReportBoundaryLogsResponse{}, nil
-}
-
-func (f *fakeReporter) getLogs() []*agentproto.ReportBoundaryLogsRequest {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return append([]*agentproto.ReportBoundaryLogsRequest{}, f.logs...)
-}
-
-func TestServer_StartAndClose(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	err := srv.Start()
-	require.NoError(t, err)
-
-	// Verify socket exists and is connectable.
-	conn, err := net.Dial("unix", socketPath)
-	require.NoError(t, err)
-	err = conn.Close()
-	require.NoError(t, err)
-
-	err = srv.Close()
-	require.NoError(t, err)
-}
-
-func TestServer_ReceiveAndForwardLogs(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	reporter := &fakeReporter{}
-
-	// Start forwarder in background.
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(ctx, reporter)
-	}()
-
-	// Connect and send a log message.
-	conn, err := net.Dial("unix", socketPath)
-	require.NoError(t, err)
-	defer conn.Close()
-
-	req := &agentproto.ReportBoundaryLogsRequest{
-		Logs: []*agentproto.BoundaryLog{
-			{
-				Allowed: true,
-				Time:    timestamppb.Now(),
-				Resource: &agentproto.BoundaryLog_HttpRequest_{
-					HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-						Method: "GET",
-						Url:    "https://example.com",
-					},
-				},
-			},
-		},
-	}
-
-	sendMessage(t, conn, req)
-
-	// Wait for the reporter to receive the log.
-	require.Eventually(t, func() bool {
-		logs := reporter.getLogs()
-		return len(logs) == 1
-	}, testutil.WaitShort, testutil.IntervalFast)
-
-	logs := reporter.getLogs()
-	require.Len(t, logs, 1)
-	require.Len(t, logs[0].Logs, 1)
-	require.True(t, logs[0].Logs[0].Allowed)
-	require.Equal(t, "GET", logs[0].Logs[0].GetHttpRequest().Method)
-	require.Equal(t, "https://example.com", logs[0].Logs[0].GetHttpRequest().Url)
-
-	cancel()
-	<-forwarderDone
-}
-
-func TestServer_MultipleMessages(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	err := srv.Start()
-	require.NoError(t, err)
-	defer srv.Close()
-
-	reporter := &fakeReporter{}
-
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(ctx, reporter)
-	}()
-
-	conn, err := net.Dial("unix", socketPath)
-	require.NoError(t, err)
-	defer conn.Close()
-
-	// Send multiple messages and verify they are all received.
-	for range 5 {
-		req := &agentproto.ReportBoundaryLogsRequest{
-			Logs: []*agentproto.BoundaryLog{
-				{
-					Allowed: true,
-					Time:    timestamppb.Now(),
-					Resource: &agentproto.BoundaryLog_HttpRequest_{
-						HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-							Method: "POST",
-							Url:    "https://example.com/api",
-						},
-					},
-				},
-			},
-		}
-		sendMessage(t, conn, req)
-	}
-
-	require.Eventually(t, func() bool {
-		logs := reporter.getLogs()
-		return len(logs) == 5
-	}, testutil.WaitShort, testutil.IntervalFast)
-
-	cancel()
-	<-forwarderDone
-}
-
-func TestServer_MultipleConnections(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	reporter := &fakeReporter{}
-
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(ctx, reporter)
-	}()
-
-	// Create multiple connections and send from each.
-	const numConns = 3
-	var wg sync.WaitGroup
-	wg.Add(numConns)
-	for i := range numConns {
-		go func(connID int) {
-			defer wg.Done()
-			conn, err := net.Dial("unix", socketPath)
-			if err != nil {
-				t.Errorf("conn %d dial: %s", connID, err)
-			}
-			defer conn.Close()
-
-			req := &agentproto.ReportBoundaryLogsRequest{
-				Logs: []*agentproto.BoundaryLog{
-					{
-						Allowed: true,
-						Time:    timestamppb.Now(),
-						Resource: &agentproto.BoundaryLog_HttpRequest_{
-							HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-								Method: "GET",
-								Url:    "https://example.com",
-							},
-						},
-					},
-				},
-			}
-			sendMessage(t, conn, req)
-		}(i)
-	}
-	wg.Wait()
-
-	require.Eventually(t, func() bool {
-		logs := reporter.getLogs()
-		return len(logs) == numConns
-	}, testutil.WaitShort, testutil.IntervalFast)
-
-	cancel()
-	<-forwarderDone
-}
-
-func TestServer_MessageTooLarge(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	conn, err := net.Dial("unix", socketPath)
-	require.NoError(t, err)
-	defer conn.Close()
-
-	// Send a message claiming to be larger than the max message size.
-	var length uint32 = codec.MaxMessageSizeV1 + 1
-	err = binary.Write(conn, binary.BigEndian, length)
-	require.NoError(t, err)
-
-	// The server should close the connection after receiving an oversized
-	// message length.
-	buf := make([]byte, 1)
-	err = conn.SetReadDeadline(time.Now().Add(time.Second))
-	require.NoError(t, err)
-	_, err = conn.Read(buf)
-	require.Error(t, err) // Should get EOF or closed connection.
-}
-
-func TestServer_ForwarderContinuesAfterError(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	reportNotify := make(chan struct{}, 1)
-	reporter := &fakeReporter{
-		// Simulate an error on the first call.
-		err:     context.DeadlineExceeded,
-		errOnce: true,
-		reportCb: func() {
-			reportNotify <- struct{}{}
-		},
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(ctx, reporter)
-	}()
-
-	conn, err := net.Dial("unix", socketPath)
-	require.NoError(t, err)
-	defer conn.Close()
-
-	// Send the first message to be processed and wait for failure.
-	req1 := &agentproto.ReportBoundaryLogsRequest{
-		Logs: []*agentproto.BoundaryLog{
-			{
-				Allowed: true,
-				Time:    timestamppb.Now(),
-				Resource: &agentproto.BoundaryLog_HttpRequest_{
-					HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-						Method: "GET",
-						Url:    "https://example.com/first",
-					},
-				},
-			},
-		},
-	}
-	sendMessage(t, conn, req1)
-
-	select {
-	case <-reportNotify:
-	case <-time.After(testutil.WaitShort):
-		t.Fatal("timed out waiting for first message to be processed")
-	}
-
-	// Send the second message, which should succeed.
-	req2 := &agentproto.ReportBoundaryLogsRequest{
-		Logs: []*agentproto.BoundaryLog{
-			{
-				Allowed: false,
-				Time:    timestamppb.Now(),
-				Resource: &agentproto.BoundaryLog_HttpRequest_{
-					HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-						Method: "POST",
-						Url:    "https://example.com/second",
-					},
-				},
-			},
-		},
-	}
-	sendMessage(t, conn, req2)
-
-	// Only the second message should be recorded.
-	require.Eventually(t, func() bool {
-		logs := reporter.getLogs()
-		return len(logs) == 1
-	}, testutil.WaitShort, testutil.IntervalFast)
-
-	logs := reporter.getLogs()
-	require.Len(t, logs, 1)
-	require.Equal(t, "https://example.com/second", logs[0].Logs[0].GetHttpRequest().Url)
-
-	cancel()
-	<-forwarderDone
-}
-
-func TestServer_CloseStopsForwarder(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	reporter := &fakeReporter{}
-
-	forwarderCtx, forwarderCancel := context.WithCancel(context.Background())
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(forwarderCtx, reporter)
-	}()
-
-	// Cancel the forwarder context and verify it stops.
-	forwarderCancel()
-
-	select {
-	case err := <-forwarderDone:
-		require.ErrorIs(t, err, context.Canceled)
-	case <-time.After(testutil.WaitShort):
-		t.Fatal("forwarder did not stop")
-	}
-}
-
-func TestServer_InvalidProtobuf(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	reporter := &fakeReporter{}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(ctx, reporter)
-	}()
-
-	conn, err := net.Dial("unix", socketPath)
-	require.NoError(t, err)
-	defer conn.Close()
-
-	// Send a valid header with garbage protobuf data.
-	// The server should log an unmarshal error but continue processing.
-	invalidProto := []byte{0xFF, 0xFF, 0xFF, 0xFF, 0xFF}
-	//nolint: gosec // codec.DataLength is always less than the size of the header.
-	header := (uint32(codec.TagV1) << codec.DataLength) | uint32(len(invalidProto))
-	err = binary.Write(conn, binary.BigEndian, header)
-	require.NoError(t, err)
-	_, err = conn.Write(invalidProto)
-	require.NoError(t, err)
-
-	// Now send a valid message. The server should continue processing.
-	req := &agentproto.ReportBoundaryLogsRequest{
-		Logs: []*agentproto.BoundaryLog{
-			{
-				Allowed: true,
-				Time:    timestamppb.Now(),
-				Resource: &agentproto.BoundaryLog_HttpRequest_{
-					HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-						Method: "GET",
-						Url:    "https://example.com/valid",
-					},
-				},
-			},
-		},
-	}
-	sendMessage(t, conn, req)
-
-	require.Eventually(t, func() bool {
-		logs := reporter.getLogs()
-		return len(logs) == 1
-	}, testutil.WaitShort, testutil.IntervalFast)
-
-	cancel()
-	<-forwarderDone
-}
-
-func TestServer_InvalidHeader(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	reporter := &fakeReporter{}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(ctx, reporter)
-	}()
-
-	// sendInvalidHeader sends a header and verifies the server closes the
-	// connection.
-	sendInvalidHeader := func(t *testing.T, name string, header uint32) {
-		t.Helper()
-
-		conn, err := net.Dial("unix", socketPath)
-		require.NoError(t, err)
-		defer conn.Close()
-
-		err = binary.Write(conn, binary.BigEndian, header)
-		require.NoError(t, err, name)
-
-		// The server closes the connection on invalid header, so the next
-		// write should fail with a broken pipe error.
-		require.Eventually(t, func() bool {
-			_, err := conn.Write([]byte{0x00})
-			return err != nil
-		}, testutil.WaitShort, testutil.IntervalFast, name)
-	}
-
-	// TagV1 with length exceeding MaxMessageSizeV1.
-	sendInvalidHeader(t, "v1 too large", (uint32(codec.TagV1)<<codec.DataLength)|(codec.MaxMessageSizeV1+1))
-
-	// Unknown tag.
-	const bogusTag = 0xFF
-	sendInvalidHeader(t, "unknown tag too large", (bogusTag<<codec.DataLength)|(codec.MaxMessageSizeV1+1))
-
-	cancel()
-	<-forwarderDone
-}
-
-func TestServer_AllowRequest(t *testing.T) {
-	t.Parallel()
-
-	socketPath := filepath.Join(testutil.TempDirUnixSocket(t), "boundary.sock")
-	srv := boundarylogproxy.NewServer(testutil.Logger(t), socketPath)
-
-	err := srv.Start()
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
-
-	reporter := &fakeReporter{}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	forwarderDone := make(chan error, 1)
-	go func() {
-		forwarderDone <- srv.RunForwarder(ctx, reporter)
-	}()
-
-	conn, err := net.Dial("unix", socketPath)
-	require.NoError(t, err)
-	defer conn.Close()
-
-	// Send an allowed request with a matched rule.
-	logTime := timestamppb.Now()
-	req := &agentproto.ReportBoundaryLogsRequest{
-		Logs: []*agentproto.BoundaryLog{
-			{
-				Allowed: true,
-				Time:    logTime,
-				Resource: &agentproto.BoundaryLog_HttpRequest_{
-					HttpRequest: &agentproto.BoundaryLog_HttpRequest{
-						Method:      "GET",
-						Url:         "https://malicious.com/attack",
-						MatchedRule: "*.malicious.com",
-					},
-				},
-			},
-		},
-	}
-	sendMessage(t, conn, req)
-
-	require.Eventually(t, func() bool {
-		logs := reporter.getLogs()
-		return len(logs) == 1
-	}, testutil.WaitShort, testutil.IntervalFast)
-
-	logs := reporter.getLogs()
-	require.Len(t, logs, 1)
-	require.True(t, logs[0].Logs[0].Allowed)
-	require.Equal(t, logTime.Seconds, logs[0].Logs[0].Time.Seconds)
-	require.Equal(t, logTime.Nanos, logs[0].Logs[0].Time.Nanos)
-	require.Equal(t, "*.malicious.com", logs[0].Logs[0].GetHttpRequest().MatchedRule)
-
-	cancel()
-	<-forwarderDone
-}
@@ -5,7 +5,7 @@ import (
 	"runtime"
 	"sync"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 )

 // checkpoint allows a goroutine to communicate when it is OK to proceed beyond some async condition
@@ -6,7 +6,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3/sloggers/slogtest"
+	"cdr.dev/slog/sloggers/slogtest"
 	"github.com/coder/coder/v2/testutil"
 )

@@ -17,7 +17,7 @@ import (
 	"golang.org/x/text/transform"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/workspacesdk"
@@ -9,7 +9,7 @@ import (
 	prompb "github.com/prometheus/client_model/go"
 	"tailscale.com/util/clientmetric"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/proto"
 )

@@ -460,37 +460,6 @@ message ListSubAgentsResponse {
 	repeated SubAgent agents = 1;
 }

-// BoundaryLog represents a log for a single resource access processed
-// by boundary.
-message BoundaryLog {
-	message HttpRequest {
-		string method = 1;
-		string url = 2;
-		// The rule that resulted in this HTTP request being allowed. Only populated
-		// when allowed = true because boundary denies requests by default and
-		// requires rule(s) that allow requests.
-		string matched_rule = 3;
-	}
-
-	// Whether boundary allowed this resource access.
-	bool allowed = 1;
-
-	// The timestamp when boundary processed this resource access.
-	google.protobuf.Timestamp time = 2;
-
-	// The resource being accessed by boundary.
-	oneof resource {
-		HttpRequest http_request = 3;
-	}
-}
-
-// ReportBoundaryLogsRequest is a request to re-emit the given BoundaryLogs.
-message ReportBoundaryLogsRequest {
-	repeated BoundaryLog logs = 1;
-}
-
-message ReportBoundaryLogsResponse {}
-
 service Agent {
 	rpc GetManifest(GetManifestRequest) returns (Manifest);
 	rpc GetServiceBanner(GetServiceBannerRequest) returns (ServiceBanner);
@@ -508,5 +477,4 @@ service Agent {
 	rpc CreateSubAgent(CreateSubAgentRequest) returns (CreateSubAgentResponse);
 	rpc DeleteSubAgent(DeleteSubAgentRequest) returns (DeleteSubAgentResponse);
 	rpc ListSubAgents(ListSubAgentsRequest) returns (ListSubAgentsResponse);
-	rpc ReportBoundaryLogs(ReportBoundaryLogsRequest) returns (ReportBoundaryLogsResponse);
 }
@@ -55,7 +55,6 @@ type DRPCAgentClient interface {
 	CreateSubAgent(ctx context.Context, in *CreateSubAgentRequest) (*CreateSubAgentResponse, error)
 	DeleteSubAgent(ctx context.Context, in *DeleteSubAgentRequest) (*DeleteSubAgentResponse, error)
 	ListSubAgents(ctx context.Context, in *ListSubAgentsRequest) (*ListSubAgentsResponse, error)
-	ReportBoundaryLogs(ctx context.Context, in *ReportBoundaryLogsRequest) (*ReportBoundaryLogsResponse, error)
 }

 type drpcAgentClient struct {
@@ -212,15 +211,6 @@ func (c *drpcAgentClient) ListSubAgents(ctx context.Context, in *ListSubAgentsRe
 	return out, nil
 }

-func (c *drpcAgentClient) ReportBoundaryLogs(ctx context.Context, in *ReportBoundaryLogsRequest) (*ReportBoundaryLogsResponse, error) {
-	out := new(ReportBoundaryLogsResponse)
-	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/ReportBoundaryLogs", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 type DRPCAgentServer interface {
 	GetManifest(context.Context, *GetManifestRequest) (*Manifest, error)
 	GetServiceBanner(context.Context, *GetServiceBannerRequest) (*ServiceBanner, error)
@@ -238,7 +228,6 @@ type DRPCAgentServer interface {
 	CreateSubAgent(context.Context, *CreateSubAgentRequest) (*CreateSubAgentResponse, error)
 	DeleteSubAgent(context.Context, *DeleteSubAgentRequest) (*DeleteSubAgentResponse, error)
 	ListSubAgents(context.Context, *ListSubAgentsRequest) (*ListSubAgentsResponse, error)
-	ReportBoundaryLogs(context.Context, *ReportBoundaryLogsRequest) (*ReportBoundaryLogsResponse, error)
 }

 type DRPCAgentUnimplementedServer struct{}
@@ -307,13 +296,9 @@ func (s *DRPCAgentUnimplementedServer) ListSubAgents(context.Context, *ListSubAg
 	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
 }

-func (s *DRPCAgentUnimplementedServer) ReportBoundaryLogs(context.Context, *ReportBoundaryLogsRequest) (*ReportBoundaryLogsResponse, error) {
-	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
-}
-
 type DRPCAgentDescription struct{}

-func (DRPCAgentDescription) NumMethods() int { return 17 }
+func (DRPCAgentDescription) NumMethods() int { return 16 }

 func (DRPCAgentDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
 	switch n {
@@ -461,15 +446,6 @@ func (DRPCAgentDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver,
 						in1.(*ListSubAgentsRequest),
 					)
 			}, DRPCAgentServer.ListSubAgents, true
-	case 16:
-		return "/coder.agent.v2.Agent/ReportBoundaryLogs", drpcEncoding_File_agent_proto_agent_proto{},
-			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
-				return srv.(DRPCAgentServer).
-					ReportBoundaryLogs(
-						ctx,
-						in1.(*ReportBoundaryLogsRequest),
-					)
-			}, DRPCAgentServer.ReportBoundaryLogs, true
 	default:
 		return "", nil, nil, nil, false
 	}
@@ -734,19 +710,3 @@ func (x *drpcAgent_ListSubAgentsStream) SendAndClose(m *ListSubAgentsResponse) e
 	}
 	return x.CloseSend()
 }
-
-type DRPCAgent_ReportBoundaryLogsStream interface {
-	drpc.Stream
-	SendAndClose(*ReportBoundaryLogsResponse) error
-}
-
-type drpcAgent_ReportBoundaryLogsStream struct {
-	drpc.Stream
-}
-
-func (x *drpcAgent_ReportBoundaryLogsStream) SendAndClose(m *ReportBoundaryLogsResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
-		return err
-	}
-	return x.CloseSend()
-}
@@ -65,10 +65,3 @@ type DRPCAgentClient26 interface {
 	DeleteSubAgent(ctx context.Context, in *DeleteSubAgentRequest) (*DeleteSubAgentResponse, error)
 	ListSubAgents(ctx context.Context, in *ListSubAgentsRequest) (*ListSubAgentsResponse, error)
 }
-
-// DRPCAgentClient27 is the Agent API at v2.7. It adds the ReportBoundaryLogs
-// RPC for forwarding boundary audit logs to coderd. Compatible with Coder v2.30+
-type DRPCAgentClient27 interface {
-	DRPCAgentClient26
-	ReportBoundaryLogs(ctx context.Context, in *ReportBoundaryLogsRequest) (*ReportBoundaryLogsResponse, error)
-}
@@ -4,7 +4,7 @@ import (
 	"context"
 	"time"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/quartz"
 )
@@ -8,8 +8,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/sloghuman"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
 	"github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/agent/proto/resourcesmonitor"
 	"github.com/coder/quartz"
@@ -12,7 +12,8 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
+
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/pty"
 )
@@ -13,7 +13,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/codersdk/workspacesdk"
 	"github.com/coder/coder/v2/pty"
@@ -18,7 +18,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/pty"
 )
@@ -13,7 +13,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/xerrors"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/agentcontainers"
 	"github.com/coder/coder/v2/agent/agentssh"
 	"github.com/coder/coder/v2/agent/usershell"
@@ -9,7 +9,7 @@ import (
 	"golang.org/x/xerrors"
 	"tailscale.com/types/netlogtype"

-	"cdr.dev/slog/v3"
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/agent/proto"
 )

@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"tailscale.com/types/ipproto"
+
 	"tailscale.com/types/netlogtype"

 	"github.com/coder/coder/v2/agent/proto"
@@ -36,13 +36,12 @@
 				"useAsConstAssertion": "error",
 				"useEnumInitializers": "error",
 				"useSingleVarDeclarator": "error",
-				"useConsistentCurlyBraces": "error",
 				"noUnusedTemplateLiteral": "error",
 				"useNumberNamespace": "error",
 				"noInferrableTypes": "error",
 				"noUselessElse": "error",
-				"noRestrictedImports": {
-					"level": "error",
+			"noRestrictedImports": {
+				"level": "error",
 					"options": {
 						"paths": {
 							// "@mui/material/Alert": "Use components/Alert/Alert instead.",
@@ -100,7 +99,7 @@
 							// "@mui/material/TextField": "Use shadcn/ui Input component instead.",
 							// "@mui/material/ToggleButton": "Use shadcn/ui Toggle or custom component instead.",
 							// "@mui/material/ToggleButtonGroup": "Use shadcn/ui Toggle or custom component instead.",
-							"@mui/material/Tooltip": "Use components/Tooltip/Tooltip instead.",
+							// "@mui/material/Tooltip": "Use shadcn/ui Tooltip component instead.",
 							"@mui/material/Typography": "Use native HTML elements instead. Eg: <span>, <p>, <h1>, etc.",
 							// "@mui/material/useMediaQuery": "Use Tailwind responsive classes or custom hook instead.",
 							// "@mui/system": "Use Tailwind CSS instead.",
@@ -16,25 +16,26 @@ import (
 	"strings"
 	"time"

-	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/xerrors"
 	"gopkg.in/natefinch/lumberjack.v2"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/sloghuman"
-	"cdr.dev/slog/v3/sloggers/slogjson"
-	"cdr.dev/slog/v3/sloggers/slogstackdriver"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+	"cdr.dev/slog/sloggers/slogjson"
+	"cdr.dev/slog/sloggers/slogstackdriver"
+	"github.com/coder/serpent"
+
 	"github.com/coder/coder/v2/agent"
 	"github.com/coder/coder/v2/agent/agentcontainers"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/agent/agentssh"
-	"github.com/coder/coder/v2/agent/boundarylogproxy"
 	"github.com/coder/coder/v2/agent/reaper"
 	"github.com/coder/coder/v2/buildinfo"
 	"github.com/coder/coder/v2/cli/clilog"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"
-	"github.com/coder/serpent"
 )

 func workspaceAgent() *serpent.Command {
@@ -58,7 +59,6 @@ func workspaceAgent() *serpent.Command {
 		devcontainerDiscoveryAutostart bool
 		socketServerEnabled            bool
 		socketPath                     string
-		boundaryLogProxySocketPath     string
 	)
 	agentAuth := &AgentAuth{}
 	cmd := &serpent.Command{
@@ -319,9 +319,8 @@ func workspaceAgent() *serpent.Command {
 						agentcontainers.WithProjectDiscovery(devcontainerProjectDiscovery),
 						agentcontainers.WithDiscoveryAutostart(devcontainerDiscoveryAutostart),
 					},
-					SocketPath:                 socketPath,
-					SocketServerEnabled:        socketServerEnabled,
-					BoundaryLogProxySocketPath: boundaryLogProxySocketPath,
+					SocketPath:          socketPath,
+					SocketServerEnabled: socketServerEnabled,
 				})

 				if debugAddress != "" {
@@ -495,13 +494,6 @@ func workspaceAgent() *serpent.Command {
 			Description: "Specify the path for the agent socket.",
 			Value:       serpent.StringOf(&socketPath),
 		},
-		{
-			Flag:        "boundary-log-proxy-socket-path",
-			Default:     boundarylogproxy.DefaultSocketPath(),
-			Env:         "CODER_AGENT_BOUNDARY_LOG_PROXY_SOCKET_PATH",
-			Description: "The path for the boundary log proxy server Unix socket. Boundary should write audit logs to this socket.",
-			Value:       serpent.StringOf(&boundaryLogProxySocketPath),
-		},
 	}
 	agentAuth.AttachOptions(cmd, false)
 	return cmd
@@ -11,10 +11,10 @@ import (
 	"golang.org/x/xerrors"
 	"gopkg.in/natefinch/lumberjack.v2"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/sloghuman"
-	"cdr.dev/slog/v3/sloggers/slogjson"
-	"cdr.dev/slog/v3/sloggers/slogstackdriver"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+	"cdr.dev/slog/sloggers/slogjson"
+	"cdr.dev/slog/sloggers/slogstackdriver"
 	"github.com/coder/coder/v2/coderd/tracing"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/serpent"
@@ -7,13 +7,13 @@ import (
 	"strings"
 	"testing"

-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
 	"github.com/coder/coder/v2/cli/clilog"
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/serpent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )

 func TestBuilder(t *testing.T) {
@@ -17,8 +17,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	"cdr.dev/slog/v3"
-	"cdr.dev/slog/v3/sloggers/slogtest"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
 	"github.com/coder/coder/v2/cli"
 	"github.com/coder/coder/v2/cli/config"
 	"github.com/coder/coder/v2/codersdk"
@@ -138,17 +138,6 @@ func normalizeGoldenFile(t *testing.T, byt []byte) []byte {

 	// The home directory changes depending on the test environment.
 	byt = bytes.ReplaceAll(byt, []byte(homeDir), []byte("~"))
-
-	// Normalize the temp directory. os.TempDir() may include a trailing slash
-	// (macOS) or not (Linux/Windows), and the temp directory may be followed by
-	// more filepath elements with an OS-specific separator. We handle all cases
-	// by replacing tempdir+separator first, then tempdir alone.
-	tempDir := filepath.Clean(os.TempDir())
-	byt = bytes.ReplaceAll(byt, []byte(tempDir+string(filepath.Separator)), []byte("/tmp/"))
-	byt = bytes.ReplaceAll(byt, []byte(tempDir), []byte("/tmp"))
-	// Clean up trailing slash when temp dir is used standalone (e.g., "/tmp/)" -> "/tmp)").
-	byt = bytes.ReplaceAll(byt, []byte("/tmp/)"), []byte("/tmp)"))
-
 	for _, r := range []struct {
 		old string
 		new string
@@ -156,6 +145,7 @@ func normalizeGoldenFile(t *testing.T, byt []byte) []byte {
 		{"\r\n", "\n"},
 		{`~\.cache\coder`, "~/.cache/coder"},
 		{`C:\Users\RUNNER~1\AppData\Local\Temp`, "/tmp"},
+		{os.TempDir(), "/tmp"},
 	} {
 		byt = bytes.ReplaceAll(byt, []byte(r.old), []byte(r.new))
 	}
@@ -13,11 +13,12 @@ import (

 	"github.com/stretchr/testify/assert"

+	"github.com/coder/coder/v2/testutil"
+
 	"github.com/coder/coder/v2/cli/cliui"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/pty/ptytest"
-	"github.com/coder/coder/v2/testutil"
 	"github.com/coder/serpent"
 )

@@ -22,9 +22,10 @@ import (
 	"golang.org/x/exp/constraints"
 	"golang.org/x/xerrors"

+	"github.com/coder/serpent"
+
 	"github.com/coder/coder/v2/cli/cliui"
 	"github.com/coder/coder/v2/codersdk"
-	"github.com/coder/serpent"
 )

 const (
@@ -1,8 +1,9 @@
 package cli

 import (
-	"github.com/coder/coder/v2/codersdk/workspacesdk"
 	"github.com/coder/serpent"
+
+	"github.com/coder/coder/v2/codersdk/workspacesdk"
 )

 func (r *RootCmd) connectCmd() *serpent.Command {
@@ -9,10 +9,11 @@ import (
 	"github.com/stretchr/testify/require"
 	"tailscale.com/net/tsaddr"

+	"github.com/coder/serpent"
+
 	"github.com/coder/coder/v2/cli"
 	"github.com/coder/coder/v2/codersdk/workspacesdk"
 	"github.com/coder/coder/v2/testutil"
-	"github.com/coder/serpent"
 )

 func TestConnectExists_Running(t *testing.T) {
@@ -12,12 +12,13 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"

+	"github.com/coder/pretty"
+
 	"github.com/coder/coder/v2/cli/cliui"
 	"github.com/coder/coder/v2/cli/cliutil"
 	"github.com/coder/coder/v2/coderd/util/ptr"
 	"github.com/coder/coder/v2/coderd/util/slice"
 	"github.com/coder/coder/v2/codersdk"
-	"github.com/coder/pretty"
 	"github.com/coder/serpent"
 )

@@ -301,13 +301,11 @@ func TestCreate(t *testing.T) {

 func prepareEchoResponses(parameters []*proto.RichParameter, presets ...*proto.Preset) *echo.Responses {
 	return &echo.Responses{
-		Parse:         echo.ParseComplete,
-		ProvisionInit: echo.InitComplete,
-		ProvisionPlan: echo.PlanComplete,
-		ProvisionGraph: []*proto.Response{
+		Parse: echo.ParseComplete,
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Response_Graph{
-					Graph: &proto.GraphComplete{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						Parameters: parameters,
 						Presets:    presets,
 					},
@@ -1575,13 +1573,11 @@ func TestCreateValidateRichParameters(t *testing.T) {
 func TestCreateWithGitAuth(t *testing.T) {
 	t.Parallel()
 	echoResponses := &echo.Responses{
-		Parse:         echo.ParseComplete,
-		ProvisionInit: echo.InitComplete,
-		ProvisionPlan: echo.PlanComplete,
-		ProvisionGraph: []*proto.Response{
+		Parse: echo.ParseComplete,
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Response_Graph{
-					Graph: &proto.GraphComplete{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						ExternalAuthProviders: []*proto.ExternalAuthProviderResource{{Id: "github"}},
 					},
 				},
@@ -10,21 +10,23 @@ import (
 	"time"

 	"github.com/google/uuid"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/quartz"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

 	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/coderd/coderdtest"
-	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
-	"github.com/coder/coder/v2/coderd/database/dbgen"
 	"github.com/coder/coder/v2/coderd/database/dbtestutil"
-	"github.com/coder/coder/v2/coderd/database/pubsub"
 	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/pty/ptytest"
 	"github.com/coder/coder/v2/testutil"
-	"github.com/coder/quartz"
 )

 func TestDelete(t *testing.T) {
@@ -13,8 +13,9 @@ import (

 	"golang.org/x/xerrors"

-	"github.com/coder/coder/v2/cli/cliui"
 	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/cliui"
 	"github.com/coder/serpent"
 )

@@ -1,18 +1,12 @@
 package cli

 import (
-	"golang.org/x/xerrors"
-
+	boundarycli "github.com/coder/boundary/cli"
 	"github.com/coder/serpent"
 )

 func (*RootCmd) boundary() *serpent.Command {
-	return &serpent.Command{
-		Use:   "boundary",
-		Short: "Network isolation tool for monitoring and restricting HTTP/HTTPS requests (enterprise)",
-		Long:  `boundary creates an isolated network environment for target processes. This is an enterprise feature.`,
-		Handler: func(_ *serpent.Invocation) error {
-			return xerrors.New("boundary is an enterprise feature; upgrade to use this command")
-		},
-	}
+	cmd := boundarycli.BaseCommand() // Package coder/boundary/cli exports a "base command" designed to be integrated as a subcommand.
+	cmd.Use += " [args...]"          // The base command looks like `boundary -- command`. Serpent adds the flags piece, but we need to add the args.
+	return cmd
 }
@@ -5,13 +5,15 @@ import (

 	"github.com/stretchr/testify/assert"

+	boundarycli "github.com/coder/boundary/cli"
 	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/pty/ptytest"
 	"github.com/coder/coder/v2/testutil"
 )

-// Here we want to test that integrating boundary as a subcommand doesn't break anything.
-// The full boundary functionality is tested in enterprise/cli.
+// Actually testing the functionality of coder/boundary takes place in the
+// coder/boundary repo, since it's a dependency of coder.
+// Here we want to test basically that integrating it as a subcommand doesn't break anything.
 func TestBoundarySubcommand(t *testing.T) {
 	t.Parallel()
 	ctx := testutil.Context(t, testutil.WaitShort)
@@ -25,5 +27,7 @@ func TestBoundarySubcommand(t *testing.T) {
 	}()

 	// Expect the --help output to include the short description.
-	pty.ExpectMatch("Network isolation tool")
+	// We're simply confirming that `coder boundary --help` ran without a runtime error as
+	// a good chunk of serpents self validation logic happens at runtime.
+	pty.ExpectMatch(boundarycli.BaseCommand().Short)
 }
--- a/Show More
+++ b/Show More