From c5288dea8bf0af0979aed416190cd08c457a1c6e Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Wed, 4 Nov 2026 17:21:33 +0000 Subject: [PATCH 1/2] feat: add coder-templates rule and coder-template-reviewer subagent Adds a rule that auto-attaches to .tf files and applies Coder template conventions, and a read-only subagent that reviews a template before it is pushed. Bumps the plugin to 0.3.0. --- .cursor-plugin/marketplace.json | 2 +- CONTRIBUTING.md | 2 + README.md | 3 + plugins/coder/.cursor-plugin/plugin.json | 2 +- plugins/coder/CHANGELOG.md | 5 ++ plugins/coder/README.md | 2 + .../coder/agents/coder-template-reviewer.md | 61 +++++++++++++++++++ plugins/coder/rules/coder-templates.mdc | 37 +++++++++++ 8 files changed, 112 insertions(+), 2 deletions(-) create mode 100644 plugins/coder/agents/coder-template-reviewer.md create mode 100644 plugins/coder/rules/coder-templates.mdc diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json index 185742f..618c731 100644 --- a/.cursor-plugin/marketplace.json +++ b/.cursor-plugin/marketplace.json @@ -6,7 +6,7 @@ }, "metadata": { "description": "Coder plugins for Cursor", - "version": "0.2.0", + "version": "0.3.0", "pluginRoot": "plugins" }, "plugins": [ diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a3f22f0..f2e2b50 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,6 +10,8 @@ plugins/coder/ The Coder plugin mcp.json Coder remote MCP server (used by /coder-agent) skills/ vendored coder/skills (workspaces, setup, templates, modules) commands/ /coder-agent + rules/ coder-templates rule + agents/ coder-template-reviewer subagent assets/logo.svg scripts/validate-template.mjs Manifest and frontmatter validation .github/scripts/sync-skills.mjs Re-vendor skills from coder/skills diff --git a/README.md b/README.md index b5fcfcf..7de6e5b 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,8 @@ workspaces, templates, and Coder Agents. | **Skill** | `modules` | Add or update modules from [registry.coder.com](https://registry.coder.com/modules) in an existing template, such as IDEs, AI agents, and dotfiles. | | **MCP** | Coder MCP server | Remote MCP server at `${CODER_URL}/api/experimental/mcp/http`, authenticated with OAuth2. Gives the agent Coder's own tools for workspaces, templates, files, logs, and Coder Agents chats. Required by `/coder-agent`; the skills work without it. | | **Command** | `/coder-agent` | Delegate a task to a Coder Agent on your deployment and supervise it: create the chat, relay questions, and report the outcome. Requires the MCP server. | +| **Rule** | `coder-templates` | Auto-attaches to `.tf` files and applies Coder template conventions when the file uses the `coder/coder` provider: parameters vs. variables, agent and lifecycle setup, pinned modules, and no secrets in code. | +| **Subagent** | `coder-template-reviewer` | Read-only review of a Coder template before you push it. Runs `terraform fmt -check`, and `terraform validate` if the template is initialized, then reports findings by severity with `file:line` and a fix. | The `workspaces`, `setup`, `templates`, and `modules` skills are vendored from [coder/skills](https://github.com/coder/skills). See [VENDOR.md](VENDOR.md). @@ -106,6 +108,7 @@ whatever session the `coder` CLI already has from `coder login`. | "Which templates can I use, and what parameters does `kubernetes` take?" | Uses the `templates` skill to inspect templates. | | "Add JetBrains Gateway to my Docker template." | Uses the `modules` skill to add the registry module. | | "Set up Coder on this VM." | Uses the `setup` skill to install and bootstrap a deployment. | +| "Review my template before I push it." | Runs the `coder-template-reviewer` subagent and reports findings without editing files. | | "Delegate this refactor to a Coder Agent and tell me when it's done." | Creates a Coder Agents chat with `coder_create_chat` and waits with `coder_await_chat`. | ## Self-hosted and air-gapped deployments diff --git a/plugins/coder/.cursor-plugin/plugin.json b/plugins/coder/.cursor-plugin/plugin.json index 9e4f2c6..e265eb7 100644 --- a/plugins/coder/.cursor-plugin/plugin.json +++ b/plugins/coder/.cursor-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "coder", "displayName": "Coder", - "version": "0.2.0", + "version": "0.3.0", "description": "Skills for installing, configuring, and operating a self-hosted Coder deployment from the Cursor IDE, plus the Coder MCP server for managing and using the deployment: workspaces, templates, and Coder Agents.", "author": { "name": "Coder", diff --git a/plugins/coder/CHANGELOG.md b/plugins/coder/CHANGELOG.md index 4e752eb..5ed6304 100644 --- a/plugins/coder/CHANGELOG.md +++ b/plugins/coder/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 0.3.0 + +- Added the `coder-templates` rule, which auto-attaches to `.tf` files and applies Coder template conventions when the file uses the `coder/coder` provider. +- Added the `coder-template-reviewer` subagent, a read-only reviewer that checks a template for build, lifecycle, parameter, module, and secret issues before it is pushed. + ## 0.2.0 - Added the Coder remote MCP server (`mcp.json`) and the `/coder-agent` command for delegating tasks to Coder Agents chats. Requires Coder v2.38 or later, with the `mcp-server-http` experiment and `CODER_OAUTH2_PROVIDER_ENABLE=true`. diff --git a/plugins/coder/README.md b/plugins/coder/README.md index fa66f2a..efbcdf3 100644 --- a/plugins/coder/README.md +++ b/plugins/coder/README.md @@ -9,6 +9,8 @@ and using the deployment: workspaces, templates, and Coder Agents. - `skills/workspaces/`, `skills/setup/`, `skills/templates/`, `skills/modules/`: vendored from [coder/skills](https://github.com/coder/skills) - `mcp.json`: Coder remote MCP server at `${CODER_URL}/api/experimental/mcp/http`, where `${CODER_URL}` is the plugin variable the user sets under **Configure** (not a shell environment variable). Gives the agent Coder's tools for workspaces, templates, files, and Coder Agents chats; `/coder-agent` builds on it. - `commands/coder-agent.md`: delegate a task to a Coder Agent and supervise it, through MCP +- `rules/coder-templates.mdc`: Coder template conventions, auto-attached to `.tf` files that use the `coder/coder` provider +- `agents/coder-template-reviewer.md`: read-only subagent that reviews a template before it is pushed See the [repository README](../../README.md) for setup and usage, and [CHANGELOG.md](CHANGELOG.md) for release history. diff --git a/plugins/coder/agents/coder-template-reviewer.md b/plugins/coder/agents/coder-template-reviewer.md new file mode 100644 index 0000000..15eeab9 --- /dev/null +++ b/plugins/coder/agents/coder-template-reviewer.md @@ -0,0 +1,61 @@ +--- +name: coder-template-reviewer +description: Reviews a Coder template (Terraform that uses the coder/coder provider) for correctness, lifecycle, and security issues before it is pushed. Use proactively after creating or editing a template, or when asked to review one. Read-only; reports findings without editing files. +model: inherit +readonly: true +--- + +# Coder template reviewer + +You review Coder templates. A template is Terraform that Coder runs to +build a workspace. Report problems; do not edit files. + +## Scope + +Review the template directory you are given. If none is given, find +the nearest directory with a `.tf` file that declares the `coder/coder` +provider. If you find none, say so and stop. + +## Checks + +Run `terraform fmt -check -diff -recursive` in the template directory. +If a `.terraform/` directory already exists, also run +`terraform validate`. Otherwise, note that validation was skipped +because `terraform init` has not run. Do not run `init`, `plan`, +`apply`, or any `coder` command that changes the deployment. + +Then read every `.tf` file and check: + +1. **Providers**: `required_providers` declares `coder/coder` and the + infrastructure provider, each with a version constraint. +2. **Agent**: one `coder_agent` per machine, with `os` and `arch` set + and no deprecated `dir` argument. The compute resource runs the + agent's `init_script` and receives its `token`. +3. **Lifecycle**: compute that should stop with the workspace uses + `count = data.coder_workspace.me.start_count`. Persistent storage + is outside that `count` and named from `data.coder_workspace.me.id`, + so stopping a workspace does not delete the user's data. +4. **Parameters**: user choices use `data "coder_parameter"` and + admin choices use `variable`. Each parameter has a `display_name` + and `description`. `mutable = true` is set only where a change on + rebuild is safe, such as not on a value that would replace the + persistent disk. Enums use `option` blocks; free-form input has + `validation` where it matters. +5. **Modules**: every `registry.coder.com` module pins `version`, + passes `agent_id`, and matches the usage in its registry README + (most set `count = data.coder_workspace.me.start_count`). +6. **Secrets**: no credentials, OAuth secrets, tokens, or private keys + in `.tf` or `.tfvars` files. Variables that hold secrets are marked + `sensitive = true`. + +When you are unsure whether something is current, check + and the module's page on +. + +## Report + +Group findings as **Must fix** (fails to build, loses data, or leaks a +secret), **Should fix** (works but fragile or confusing), and **Nit**. +For each, give `file:line`, the problem in one sentence, and the fix. +End with the `fmt` and `validate` results. If you find nothing, say so +in one line. diff --git a/plugins/coder/rules/coder-templates.mdc b/plugins/coder/rules/coder-templates.mdc new file mode 100644 index 0000000..239d7b0 --- /dev/null +++ b/plugins/coder/rules/coder-templates.mdc @@ -0,0 +1,37 @@ +--- +description: Conventions for Coder templates, the Terraform files that use the coder/coder provider. Applies while creating or editing a template. +globs: "**/*.tf" +alwaysApply: false +--- + +# Coder template conventions + +Apply this rule only to Terraform that declares the `coder/coder` +provider. Ignore it for other Terraform. + +For scaffolding, pulling, pushing, and testing, follow the `templates` +skill. For adding registry modules, follow the `modules` skill. + +- Use `data "coder_parameter"` for choices the workspace user makes + (image, CPU, memory, repository). Use a Terraform `variable` for + choices the admin fixes at push time (architecture, cluster, storage + pool). Never expose infrastructure details as parameters. +- Give each `coder_parameter` a `display_name` and `description`. Set + `mutable = true` only when changing the value on rebuild is safe. Use + `option` blocks for enums and `validation` blocks for ranges and + patterns. +- Define one `coder_agent` per machine. Do not set the deprecated `dir` + argument; the agent starts in `$HOME`. +- Set `count = data.coder_workspace.me.start_count` on compute that + should stop with the workspace. Keep persistent storage (the home + volume or disk) outside that `count`, and name it from + `data.coder_workspace.me.id` so it survives stop and start. +- Pin `version` on every `registry.coder.com` module and pass the + agent with `agent_id`. +- Never put credentials, OAuth secrets, or tokens in `.tf` or + `.tfvars` files. Mark sensitive variables `sensitive = true` and + rely on the provisioner's own cloud authentication. +- Before pushing, run `terraform fmt` and `terraform validate`, and + offer the `coder-template-reviewer` subagent for a review. +- Do not pass `--activate` to `coder templates push` while the user is + still iterating. From 1cd79a4de4e6d186549243223b928fc865ece58b Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Wed, 4 Nov 2026 17:48:37 +0000 Subject: [PATCH 2/2] fix: stop treating coder_agent dir as deprecated Provider 2.20.0 removed the deprecation, so the rule and reviewer now treat dir as optional instead of flagging it. --- plugins/coder/agents/coder-template-reviewer.md | 7 ++++--- plugins/coder/rules/coder-templates.mdc | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/plugins/coder/agents/coder-template-reviewer.md b/plugins/coder/agents/coder-template-reviewer.md index 15eeab9..e835078 100644 --- a/plugins/coder/agents/coder-template-reviewer.md +++ b/plugins/coder/agents/coder-template-reviewer.md @@ -28,9 +28,10 @@ Then read every `.tf` file and check: 1. **Providers**: `required_providers` declares `coder/coder` and the infrastructure provider, each with a version constraint. -2. **Agent**: one `coder_agent` per machine, with `os` and `arch` set - and no deprecated `dir` argument. The compute resource runs the - agent's `init_script` and receives its `token`. +2. **Agent**: one `coder_agent` per machine, with `os` and `arch` set. + The compute resource runs the agent's `init_script` and receives its + `token`. `dir` is optional and not deprecated (provider 2.20.0 removed + the deprecation), so do not flag it. 3. **Lifecycle**: compute that should stop with the workspace uses `count = data.coder_workspace.me.start_count`. Persistent storage is outside that `count` and named from `data.coder_workspace.me.id`, diff --git a/plugins/coder/rules/coder-templates.mdc b/plugins/coder/rules/coder-templates.mdc index 239d7b0..3dff10f 100644 --- a/plugins/coder/rules/coder-templates.mdc +++ b/plugins/coder/rules/coder-templates.mdc @@ -20,8 +20,8 @@ skill. For adding registry modules, follow the `modules` skill. `mutable = true` only when changing the value on rebuild is safe. Use `option` blocks for enums and `validation` blocks for ranges and patterns. -- Define one `coder_agent` per machine. Do not set the deprecated `dir` - argument; the agent starts in `$HOME`. +- Define one `coder_agent` per machine. `dir` is optional and defaults + to `$HOME`; set it only when users should land in a project checkout. - Set `count = data.coder_workspace.me.start_count` on compute that should stop with the workspace. Keep persistent storage (the home volume or disk) outside that `count`, and name it from