feat: add coder-templates rule and coder-template-reviewer subagent

.cursor-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Coder plugins for Cursor",
-    "version": "0.2.0",
+    "version": "0.3.0",
     "pluginRoot": "plugins"
   },
   "plugins": [

CONTRIBUTING.md

@@ -10,6 +10,8 @@ plugins/coder/                    The Coder plugin
   mcp.json                        Coder remote MCP server (used by /coder-agent)
   skills/                         vendored coder/skills (workspaces, setup, templates, modules)
   commands/                       /coder-agent
+  rules/                          coder-templates rule
+  agents/                         coder-template-reviewer subagent
   assets/logo.svg
 scripts/validate-template.mjs     Manifest and frontmatter validation
 .github/scripts/sync-skills.mjs   Re-vendor skills from coder/skills

README.md

@@ -15,6 +15,8 @@ workspaces, templates, and Coder Agents.
 | **Skill** | `modules` | Add or update modules from [registry.coder.com](https://registry.coder.com/modules) in an existing template, such as IDEs, AI agents, and dotfiles. |
 | **MCP** | Coder MCP server | Remote MCP server at `${CODER_URL}/api/experimental/mcp/http`, authenticated with OAuth2. Gives the agent Coder's own tools for workspaces, templates, files, logs, and Coder Agents chats. Required by `/coder-agent`; the skills work without it. |
 | **Command** | `/coder-agent` | Delegate a task to a Coder Agent on your deployment and supervise it: create the chat, relay questions, and report the outcome. Requires the MCP server. |
+| **Rule** | `coder-templates` | Auto-attaches to `.tf` files and applies Coder template conventions when the file uses the `coder/coder` provider: parameters vs. variables, agent and lifecycle setup, pinned modules, and no secrets in code. |
+| **Subagent** | `coder-template-reviewer` | Read-only review of a Coder template before you push it. Runs `terraform fmt -check`, and `terraform validate` if the template is initialized, then reports findings by severity with `file:line` and a fix. |
 
 The `workspaces`, `setup`, `templates`, and `modules` skills are vendored
 from [coder/skills](https://github.com/coder/skills). See [VENDOR.md](VENDOR.md).
@@ -106,6 +108,7 @@ whatever session the `coder` CLI already has from `coder login`.
 | "Which templates can I use, and what parameters does `kubernetes` take?" | Uses the `templates` skill to inspect templates. |
 | "Add JetBrains Gateway to my Docker template." | Uses the `modules` skill to add the registry module. |
 | "Set up Coder on this VM." | Uses the `setup` skill to install and bootstrap a deployment. |
+| "Review my template before I push it." | Runs the `coder-template-reviewer` subagent and reports findings without editing files. |
 | "Delegate this refactor to a Coder Agent and tell me when it's done." | Creates a Coder Agents chat with `coder_create_chat` and waits with `coder_await_chat`. |
 
 ## Self-hosted and air-gapped deployments

plugins/coder/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "coder",
   "displayName": "Coder",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Skills for installing, configuring, and operating a self-hosted Coder deployment from the Cursor IDE, plus the Coder MCP server for managing and using the deployment: workspaces, templates, and Coder Agents.",
   "author": {
     "name": "Coder",

plugins/coder/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.3.0
+
+- Added the `coder-templates` rule, which auto-attaches to `.tf` files and applies Coder template conventions when the file uses the `coder/coder` provider.
+- Added the `coder-template-reviewer` subagent, a read-only reviewer that checks a template for build, lifecycle, parameter, module, and secret issues before it is pushed.
+
 ## 0.2.0
 
 - Added the Coder remote MCP server (`mcp.json`) and the `/coder-agent` command for delegating tasks to Coder Agents chats. Requires Coder v2.38 or later, with the `mcp-server-http` experiment and `CODER_OAUTH2_PROVIDER_ENABLE=true`.

plugins/coder/README.md

@@ -9,6 +9,8 @@ and using the deployment: workspaces, templates, and Coder Agents.
 - `skills/workspaces/`, `skills/setup/`, `skills/templates/`, `skills/modules/`: vendored from [coder/skills](https://github.com/coder/skills)
 - `mcp.json`: Coder remote MCP server at `${CODER_URL}/api/experimental/mcp/http`, where `${CODER_URL}` is the plugin variable the user sets under **Configure** (not a shell environment variable). Gives the agent Coder's tools for workspaces, templates, files, and Coder Agents chats; `/coder-agent` builds on it.
 - `commands/coder-agent.md`: delegate a task to a Coder Agent and supervise it, through MCP
+- `rules/coder-templates.mdc`: Coder template conventions, auto-attached to `.tf` files that use the `coder/coder` provider
+- `agents/coder-template-reviewer.md`: read-only subagent that reviews a template before it is pushed
 
 See the [repository README](../../README.md) for setup and usage, and
 [CHANGELOG.md](CHANGELOG.md) for release history.

plugins/coder/agents/coder-template-reviewer.md

@@ -0,0 +1,62 @@
+---
+name: coder-template-reviewer
+description: Reviews a Coder template (Terraform that uses the coder/coder provider) for correctness, lifecycle, and security issues before it is pushed. Use proactively after creating or editing a template, or when asked to review one. Read-only; reports findings without editing files.
+model: inherit
+readonly: true
+---
+
+# Coder template reviewer
+
+You review Coder templates. A template is Terraform that Coder runs to
+build a workspace. Report problems; do not edit files.
+
+## Scope
+
+Review the template directory you are given. If none is given, find
+the nearest directory with a `.tf` file that declares the `coder/coder`
+provider. If you find none, say so and stop.
+
+## Checks
+
+Run `terraform fmt -check -diff -recursive` in the template directory.
+If a `.terraform/` directory already exists, also run
+`terraform validate`. Otherwise, note that validation was skipped
+because `terraform init` has not run. Do not run `init`, `plan`,
+`apply`, or any `coder` command that changes the deployment.
+
+Then read every `.tf` file and check:
+
+1. **Providers**: `required_providers` declares `coder/coder` and the
+   infrastructure provider, each with a version constraint.
+2. **Agent**: one `coder_agent` per machine, with `os` and `arch` set.
+   The compute resource runs the agent's `init_script` and receives its
+   `token`. `dir` is optional and not deprecated (provider 2.20.0 removed
+   the deprecation), so do not flag it.
+3. **Lifecycle**: compute that should stop with the workspace uses
+   `count = data.coder_workspace.me.start_count`. Persistent storage
+   is outside that `count` and named from `data.coder_workspace.me.id`,
+   so stopping a workspace does not delete the user's data.
+4. **Parameters**: user choices use `data "coder_parameter"` and
+   admin choices use `variable`. Each parameter has a `display_name`
+   and `description`. `mutable = true` is set only where a change on
+   rebuild is safe, such as not on a value that would replace the
+   persistent disk. Enums use `option` blocks; free-form input has
+   `validation` where it matters.
+5. **Modules**: every `registry.coder.com` module pins `version`,
+   passes `agent_id`, and matches the usage in its registry README
+   (most set `count = data.coder_workspace.me.start_count`).
+6. **Secrets**: no credentials, OAuth secrets, tokens, or private keys
+   in `.tf` or `.tfvars` files. Variables that hold secrets are marked
+   `sensitive = true`.
+
+When you are unsure whether something is current, check
+<https://coder.com/docs/llms.txt> and the module's page on
+<https://registry.coder.com>.
+
+## Report
+
+Group findings as **Must fix** (fails to build, loses data, or leaks a
+secret), **Should fix** (works but fragile or confusing), and **Nit**.
+For each, give `file:line`, the problem in one sentence, and the fix.
+End with the `fmt` and `validate` results. If you find nothing, say so
+in one line.

plugins/coder/rules/coder-templates.mdc

@@ -0,0 +1,37 @@
+---
+description: Conventions for Coder templates, the Terraform files that use the coder/coder provider. Applies while creating or editing a template.
+globs: "**/*.tf"
+alwaysApply: false
+---
+
+# Coder template conventions
+
+Apply this rule only to Terraform that declares the `coder/coder`
+provider. Ignore it for other Terraform.
+
+For scaffolding, pulling, pushing, and testing, follow the `templates`
+skill. For adding registry modules, follow the `modules` skill.
+
+- Use `data "coder_parameter"` for choices the workspace user makes
+  (image, CPU, memory, repository). Use a Terraform `variable` for
+  choices the admin fixes at push time (architecture, cluster, storage
+  pool). Never expose infrastructure details as parameters.
+- Give each `coder_parameter` a `display_name` and `description`. Set
+  `mutable = true` only when changing the value on rebuild is safe. Use
+  `option` blocks for enums and `validation` blocks for ranges and
+  patterns.
+- Define one `coder_agent` per machine. `dir` is optional and defaults
+  to `$HOME`; set it only when users should land in a project checkout.
+- Set `count = data.coder_workspace.me.start_count` on compute that
+  should stop with the workspace. Keep persistent storage (the home
+  volume or disk) outside that `count`, and name it from
+  `data.coder_workspace.me.id` so it survives stop and start.
+- Pin `version` on every `registry.coder.com` module and pass the
+  agent with `agent_id`.
+- Never put credentials, OAuth secrets, or tokens in `.tf` or
+  `.tfvars` files. Mark sensitive variables `sensitive = true` and
+  rely on the provisioner's own cloud authentication.
+- Before pushing, run `terraform fmt` and `terraform validate`, and
+  offer the `coder-template-reviewer` subagent for a review.
+- Do not pass `--activate` to `coder templates push` while the user is
+  still iterating.