🤖 fix: trust only Coder's own 404 in the CoderAIProvider sync and disable paths

[ThomasK33]

Summary

The CoderAIProvider sync and disable paths now trust only Coder's own 404, as the delete path does since #325. This must land before the next release tag (#327).

Fixes #327
Refs #154

Why

Before this change, any 404 counted as "the provider is gone": an HTML page from a proxy, or Coder's Route not found. for a wrong base URL.

• Sync, after a spec edit (not yet applied): such a 404 made providerGone clear status.providerID and status.credential. The create path then read the provider by name, saw a display name that was no longer the nonce, and stalled with NameConflict. The object lost ownership for good: a later credential failure no longer disabled the provider, and a delete released the finalizer without deleting it in Coder.
• Sync, applied provider: the same 404 stalled the object with the wrong reason, DeletedExternally.
• Disable: a 404 on the read before the disable stalled the object with "Provider X does not exist in Coder." and sent no enabled: false.

What

isCoderResourceNotFound (from #325: a 404 whose message is Coder's fixed Resource not found or you do not have access to this resource) now decides at the three remaining provider-by-ID reads:

1. The sync GET by ID (coderaiprovider_sync.go).
2. The sync re-read after a 404 PATCH (coderaiprovider_sync.go).
3. The GET before the disable PATCH (coderaiprovider_disable.go).

Any other 404 falls through to the existing error branches: sync waits with CoderUnavailable (30 s) and changes nothing; disable waits with "Coder can still send the key of provider X ..." (30 s) and retries the disable.

The create path's name lookups keep isCoderNotFound: there a 404 leads to a create attempt or to the site-owner check, not to a loss of ownership.

Tests

• TestCoderAIProviderSyncNotCoder404: an HTML 404 and Route not found. on the sync GET, for an applied provider and after a spec edit. Each waits with CoderUnavailable, keeps providerID and credential, and sends no write. The next reconcile is Ready, with no second create.
• TestCoderAIProviderSyncUpdate404NotCoderRead: after a spec edit, the PATCH answers Coder's 404 and the re-read answers a non-Coder 404. The object waits (get provider ... after a 404 update) and keeps ownership; the next reconcile is Ready.
• TestCoderAIProviderDisableNotCoder404: with the key Secret's label removed, a non-Coder 404 on the read waits with "Coder can still send the key" and the provider stays enabled; the next reconcile disables it.
• The existing "deleted right after the create" case now injects Coder's own 404 message.

Mutation checks (each one breaks a named test, then I reverted it): isCoderNotFound back on the sync GET, on the sync re-read, and on the disable GET.

Local gates on the pushed tree, exit 0 each: make verify-vendor, make test, make test-integration, make build, make lint, go tool govulncheck ./..., go test -race ./internal/controller/, and make codegen manifests build-installer docs-reference with no diff.

---

Generated with mux • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $116.80

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T06:27:13.066130Z	adf7e26	PR opened
🔒 Security Review	✅ Completed 2026-10-14T06:29:20.026784Z	adf7e26	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: adf7e26fc9

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.