Klomgor · pull · Aug 20, 2025 · Aug 20, 2025 · Aug 20, 2025 · Aug 20, 2025
diff --git a/Makefile b/Makefile
@@ -636,7 +636,8 @@ GEN_FILES := \
 	coderd/database/pubsub/psmock/psmock.go \
 	agent/agentcontainers/acmock/acmock.go \
 	agent/agentcontainers/dcspec/dcspec_gen.go \
-	coderd/httpmw/loggermw/loggermock/loggermock.go
+	coderd/httpmw/loggermw/loggermock/loggermock.go \
+	codersdk/workspacesdk/agentconnmock/agentconnmock.go
 
 # all gen targets should be added here and to gen/mark-fresh
 gen: gen/db gen/golden-files $(GEN_FILES)
@@ -686,6 +687,7 @@ gen/mark-fresh:
 		agent/agentcontainers/acmock/acmock.go \
 		agent/agentcontainers/dcspec/dcspec_gen.go \
 		coderd/httpmw/loggermw/loggermock/loggermock.go \
+		codersdk/workspacesdk/agentconnmock/agentconnmock.go \
 		"
 
 	for file in $$files; do
@@ -729,6 +731,10 @@ coderd/httpmw/loggermw/loggermock/loggermock.go: coderd/httpmw/loggermw/logger.g
 	go generate ./coderd/httpmw/loggermw/loggermock/
 	touch "$@"
 
+codersdk/workspacesdk/agentconnmock/agentconnmock.go: codersdk/workspacesdk/agentconn.go
+	go generate ./codersdk/workspacesdk/agentconnmock/
+	touch "$@"
+
 agent/agentcontainers/dcspec/dcspec_gen.go: \
 	node_modules/.installed \
 	agent/agentcontainers/dcspec/devContainer.base.schema.json \

diff --git a/agent/agent_test.go b/agent/agent_test.go
@@ -2750,9 +2750,9 @@ func TestAgent_Dial(t *testing.T) {
 
 				switch l.Addr().Network() {
 				case "tcp":
-					conn, err = agentConn.Conn.DialContextTCP(ctx, ipp)
+					conn, err = agentConn.TailnetConn().DialContextTCP(ctx, ipp)
 				case "udp":
-					conn, err = agentConn.Conn.DialContextUDP(ctx, ipp)
+					conn, err = agentConn.TailnetConn().DialContextUDP(ctx, ipp)
 				default:
 					t.Fatalf("unknown network: %s", l.Addr().Network())
 				}
@@ -2811,7 +2811,7 @@ func TestAgent_UpdatedDERP(t *testing.T) {
 	})
 
 	// Setup a client connection.
-	newClientConn := func(derpMap *tailcfg.DERPMap, name string) *workspacesdk.AgentConn {
+	newClientConn := func(derpMap *tailcfg.DERPMap, name string) workspacesdk.AgentConn {
 		conn, err := tailnet.NewConn(&tailnet.Options{
 			Addresses: []netip.Prefix{tailnet.TailscaleServicePrefix.RandomPrefix()},
 			DERPMap:   derpMap,
@@ -2891,13 +2891,13 @@ func TestAgent_UpdatedDERP(t *testing.T) {
 
 	// Connect from a second client and make sure it uses the new DERP map.
 	conn2 := newClientConn(newDerpMap, "client2")
-	require.Equal(t, []int{2}, conn2.DERPMap().RegionIDs())
+	require.Equal(t, []int{2}, conn2.TailnetConn().DERPMap().RegionIDs())
 	t.Log("conn2 got the new DERPMap")
 
 	// If the first client gets a DERP map update, it should be able to
 	// reconnect just fine.
-	conn1.SetDERPMap(newDerpMap)
-	require.Equal(t, []int{2}, conn1.DERPMap().RegionIDs())
+	conn1.TailnetConn().SetDERPMap(newDerpMap)
+	require.Equal(t, []int{2}, conn1.TailnetConn().DERPMap().RegionIDs())
 	t.Log("set the new DERPMap on conn1")
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -3264,7 +3264,7 @@ func setupSSHSessionOnPort(
 }
 
 func setupAgent(t testing.TB, metadata agentsdk.Manifest, ptyTimeout time.Duration, opts ...func(*agenttest.Client, *agent.Options)) (
-	*workspacesdk.AgentConn,
+	workspacesdk.AgentConn,
 	*agenttest.Client,
 	<-chan *proto.Stats,
 	afero.Fs,

diff --git a/agent/agentssh/agentssh.go b/agent/agentssh/agentssh.go
@@ -46,6 +46,8 @@ const (
 	// MagicProcessCmdlineJetBrains is a string in a process's command line that
 	// uniquely identifies it as JetBrains software.
 	MagicProcessCmdlineJetBrains = "idea.vendor.name=JetBrains"
+	MagicProcessCmdlineToolbox   = "com.jetbrains.toolbox"
+	MagicProcessCmdlineGateway   = "remote-dev-server"
 
 	// BlockedFileTransferErrorCode indicates that SSH server restricted the raw command from performing
 	// the file transfer.

diff --git a/agent/agentssh/jetbrainstrack.go b/agent/agentssh/jetbrainstrack.go
@@ -53,7 +53,7 @@ func NewJetbrainsChannelWatcher(ctx ssh.Context, logger slog.Logger, reportConne
 
 	// If this is not JetBrains, then we do not need to do anything special.  We
 	// attempt to match on something that appears unique to JetBrains software.
-	if !strings.Contains(strings.ToLower(cmdline), strings.ToLower(MagicProcessCmdlineJetBrains)) {
+	if !isJetbrainsProcess(cmdline) {
 		return newChannel
 	}
 
@@ -104,3 +104,18 @@ func (c *ChannelOnClose) Close() error {
 	c.once.Do(c.done)
 	return c.Channel.Close()
 }
+
+func isJetbrainsProcess(cmdline string) bool {
+	opts := []string{
+		MagicProcessCmdlineJetBrains,
+		MagicProcessCmdlineToolbox,
+		MagicProcessCmdlineGateway,
+	}
+
+	for _, opt := range opts {
+		if strings.Contains(strings.ToLower(cmdline), strings.ToLower(opt)) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/cli/delete_test.go b/cli/delete_test.go
@@ -111,7 +111,6 @@ func TestDelete(t *testing.T) {
 		// The API checks if the user has any workspaces, so we cannot delete a user
 		// this way.
 		ctx := testutil.Context(t, testutil.WaitShort)
-		// nolint:gocritic // Unit test
 		err := api.Database.UpdateUserDeletedByID(dbauthz.AsSystemRestricted(ctx), deleteMeUser.ID)
 		require.NoError(t, err)
 

diff --git a/cli/ping.go b/cli/ping.go
@@ -147,7 +147,7 @@ func (r *RootCmd) ping() *serpent.Command {
 			}
 			defer conn.Close()
 
-			derpMap := conn.DERPMap()
+			derpMap := conn.TailnetConn().DERPMap()
 
 			diagCtx, diagCancel := context.WithTimeout(inv.Context(), 30*time.Second)
 			defer diagCancel()
@@ -156,7 +156,7 @@ func (r *RootCmd) ping() *serpent.Command {
 			// Silent ping to determine whether we should show diags
 			_, didP2p, _, _ := conn.Ping(ctx)
 
-			ni := conn.GetNetInfo()
+			ni := conn.TailnetConn().GetNetInfo()
 			connDiags := cliui.ConnDiags{
 				DisableDirect:      r.disableDirect,
 				LocalNetInfo:       ni,

diff --git a/cli/portforward.go b/cli/portforward.go
@@ -221,7 +221,7 @@ func (r *RootCmd) portForward() *serpent.Command {
 func listenAndPortForward(
 	ctx context.Context,
 	inv *serpent.Invocation,
-	conn *workspacesdk.AgentConn,
+	conn workspacesdk.AgentConn,
 	wg *sync.WaitGroup,
 	spec portForwardSpec,
 	logger slog.Logger,

diff --git a/cli/provisioners_test.go b/cli/provisioners_test.go
@@ -31,7 +31,6 @@ func TestProvisioners_Golden(t *testing.T) {
 	// Replace UUIDs with predictable values for golden files.
 	replace := make(map[string]string)
 	updateReplaceUUIDs := func(coderdAPI *coderd.API) {
-		//nolint:gocritic // This is a test.
 		systemCtx := dbauthz.AsSystemRestricted(context.Background())
 		provisioners, err := coderdAPI.Database.GetProvisionerDaemons(systemCtx)
 		require.NoError(t, err)

diff --git a/cli/speedtest.go b/cli/speedtest.go
@@ -139,7 +139,7 @@ func (r *RootCmd) speedtest() *serpent.Command {
 					if err != nil {
 						continue
 					}
-					status := conn.Status()
+					status := conn.TailnetConn().Status()
 					if len(status.Peers()) != 1 {
 						continue
 					}
@@ -189,7 +189,7 @@ func (r *RootCmd) speedtest() *serpent.Command {
 					outputResult.Intervals[i] = interval
 				}
 			}
-			conn.Conn.SendSpeedtestTelemetry(outputResult.Overall.ThroughputMbits)
+			conn.TailnetConn().SendSpeedtestTelemetry(outputResult.Overall.ThroughputMbits)
 			out, err := formatter.Format(inv.Context(), outputResult)
 			if err != nil {
 				return err

diff --git a/cli/ssh.go b/cli/ssh.go
@@ -590,7 +590,7 @@ func (r *RootCmd) ssh() *serpent.Command {
 				}
 
 				err = sshSession.Wait()
-				conn.SendDisconnectedTelemetry()
+				conn.TailnetConn().SendDisconnectedTelemetry()
 				if err != nil {
 					if exitErr := (&gossh.ExitError{}); errors.As(err, &exitErr) {
 						// Clear the error since it's not useful beyond
@@ -1364,7 +1364,7 @@ func getUsageAppName(usageApp string) codersdk.UsageAppName {
 
 func setStatsCallback(
 	ctx context.Context,
-	agentConn *workspacesdk.AgentConn,
+	agentConn workspacesdk.AgentConn,
 	logger slog.Logger,
 	networkInfoDir string,
 	networkInfoInterval time.Duration,
@@ -1437,7 +1437,7 @@ func setStatsCallback(
 
 	now := time.Now()
 	cb(now, now.Add(time.Nanosecond), map[netlogtype.Connection]netlogtype.Counts{}, map[netlogtype.Connection]netlogtype.Counts{})
-	agentConn.SetConnStatsCallback(networkInfoInterval, 2048, cb)
+	agentConn.TailnetConn().SetConnStatsCallback(networkInfoInterval, 2048, cb)
 	return errCh, nil
 }
 
@@ -1451,13 +1451,13 @@ type sshNetworkStats struct {
 	UsingCoderConnect bool               `json:"using_coder_connect"`
 }
 
-func collectNetworkStats(ctx context.Context, agentConn *workspacesdk.AgentConn, start, end time.Time, counts map[netlogtype.Connection]netlogtype.Counts) (*sshNetworkStats, error) {
+func collectNetworkStats(ctx context.Context, agentConn workspacesdk.AgentConn, start, end time.Time, counts map[netlogtype.Connection]netlogtype.Counts) (*sshNetworkStats, error) {
 	latency, p2p, pingResult, err := agentConn.Ping(ctx)
 	if err != nil {
 		return nil, err
 	}
-	node := agentConn.Node()
-	derpMap := agentConn.DERPMap()
+	node := agentConn.TailnetConn().Node()
+	derpMap := agentConn.TailnetConn().DERPMap()
 
 	totalRx := uint64(0)
 	totalTx := uint64(0)

diff --git a/coderd/agentapi/subagent_test.go b/coderd/agentapi/subagent_test.go
@@ -163,7 +163,7 @@ func TestSubAgentAPI(t *testing.T) {
 					agentID, err := uuid.FromBytes(createResp.Agent.Id)
 					require.NoError(t, err)
 
-					agent, err := api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), agentID) //nolint:gocritic // this is a test.
+					agent, err := api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), agentID)
 					require.NoError(t, err)
 
 					assert.Equal(t, tt.agentName, agent.Name)
@@ -621,7 +621,7 @@ func TestSubAgentAPI(t *testing.T) {
 				agentID, err := uuid.FromBytes(createResp.Agent.Id)
 				require.NoError(t, err)
 
-				apps, err := api.Database.GetWorkspaceAppsByAgentID(dbauthz.AsSystemRestricted(ctx), agentID) //nolint:gocritic // this is a test.
+				apps, err := api.Database.GetWorkspaceAppsByAgentID(dbauthz.AsSystemRestricted(ctx), agentID)
 				require.NoError(t, err)
 
 				// Sort the apps for determinism
@@ -751,7 +751,7 @@ func TestSubAgentAPI(t *testing.T) {
 			agentID, err := uuid.FromBytes(createResp.Agent.Id)
 			require.NoError(t, err)
 
-			apps, err := db.GetWorkspaceAppsByAgentID(dbauthz.AsSystemRestricted(ctx), agentID) //nolint:gocritic // this is a test.
+			apps, err := db.GetWorkspaceAppsByAgentID(dbauthz.AsSystemRestricted(ctx), agentID)
 			require.NoError(t, err)
 			require.Len(t, apps, 1)
 			require.Equal(t, "k5jd7a99-duplicate-slug", apps[0].Slug)
@@ -789,7 +789,7 @@ func TestSubAgentAPI(t *testing.T) {
 			require.NoError(t, err)
 
 			// Then: It is deleted.
-			_, err = db.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), childAgent.ID) //nolint:gocritic // this is a test.
+			_, err = db.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), childAgent.ID)
 			require.ErrorIs(t, err, sql.ErrNoRows)
 		})
 
@@ -830,10 +830,10 @@ func TestSubAgentAPI(t *testing.T) {
 			require.NoError(t, err)
 
 			// Then: The correct one is deleted.
-			_, err = api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), childAgentOne.ID) //nolint:gocritic // this is a test.
+			_, err = api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), childAgentOne.ID)
 			require.ErrorIs(t, err, sql.ErrNoRows)
 
-			_, err = api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), childAgentTwo.ID) //nolint:gocritic // this is a test.
+			_, err = api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), childAgentTwo.ID)
 			require.NoError(t, err)
 		})
 
@@ -871,7 +871,7 @@ func TestSubAgentAPI(t *testing.T) {
 			var notAuthorizedError dbauthz.NotAuthorizedError
 			require.ErrorAs(t, err, &notAuthorizedError)
 
-			_, err = db.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), childAgentOne.ID) //nolint:gocritic // this is a test.
+			_, err = db.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), childAgentOne.ID)
 			require.NoError(t, err)
 		})
 
@@ -912,7 +912,7 @@ func TestSubAgentAPI(t *testing.T) {
 			require.NoError(t, err)
 
 			// Verify that the apps were created
-			apps, err := api.Database.GetWorkspaceAppsByAgentID(dbauthz.AsSystemRestricted(ctx), subAgentID) //nolint:gocritic // this is a test.
+			apps, err := api.Database.GetWorkspaceAppsByAgentID(dbauthz.AsSystemRestricted(ctx), subAgentID)
 			require.NoError(t, err)
 			require.Len(t, apps, 2)
 
@@ -923,7 +923,7 @@ func TestSubAgentAPI(t *testing.T) {
 			require.NoError(t, err)
 
 			// Then: The agent is deleted
-			_, err = api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), subAgentID) //nolint:gocritic // this is a test.
+			_, err = api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), subAgentID)
 			require.ErrorIs(t, err, sql.ErrNoRows)
 
 			// And: The apps are *retained* to avoid causing issues
@@ -1068,7 +1068,7 @@ func TestSubAgentAPI(t *testing.T) {
 					agentID, err := uuid.FromBytes(createResp.Agent.Id)
 					require.NoError(t, err)
 
-					subAgent, err := api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), agentID) //nolint:gocritic // this is a test.
+					subAgent, err := api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), agentID)
 					require.NoError(t, err)
 
 					require.Equal(t, len(tt.expectedApps), len(subAgent.DisplayApps), "display apps count mismatch")
@@ -1118,14 +1118,14 @@ func TestSubAgentAPI(t *testing.T) {
 		require.NoError(t, err)
 
 		// Verify display apps
-		subAgent, err := api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), agentID) //nolint:gocritic // this is a test.
+		subAgent, err := api.Database.GetWorkspaceAgentByID(dbauthz.AsSystemRestricted(ctx), agentID)
 		require.NoError(t, err)
 		require.Len(t, subAgent.DisplayApps, 2)
 		require.Equal(t, database.DisplayAppVscode, subAgent.DisplayApps[0])
 		require.Equal(t, database.DisplayAppWebTerminal, subAgent.DisplayApps[1])
 
 		// Verify regular apps
-		apps, err := api.Database.GetWorkspaceAppsByAgentID(dbauthz.AsSystemRestricted(ctx), agentID) //nolint:gocritic // this is a test.
+		apps, err := api.Database.GetWorkspaceAppsByAgentID(dbauthz.AsSystemRestricted(ctx), agentID)
 		require.NoError(t, err)
 		require.Len(t, apps, 1)
 		require.Equal(t, "v4qhkq17-custom-app", apps[0].Slug)
@@ -1190,7 +1190,7 @@ func TestSubAgentAPI(t *testing.T) {
 			})
 
 			// When: We list the sub agents.
-			listResp, err := api.ListSubAgents(ctx, &proto.ListSubAgentsRequest{}) //nolint:gocritic // this is a test.
+			listResp, err := api.ListSubAgents(ctx, &proto.ListSubAgentsRequest{})
 			require.NoError(t, err)
 
 			listedChildAgents := listResp.Agents