🤖 fix: trust only Coder's own 404 before a CoderMCPServer config counts as gone

[ThomasK33]

Summary

The dormant CoderMCPServer reconciler now treats only Coder's own 404 as proof that a config is gone. A proxy HTML 404 or Coder's Route not found. (a wrong base URL) waits and changes nothing. The kind is not registered, so users see no change.

Fixes #337

Background

#328 to #330 read the config by ID in two places and treated any 404 as "gone":

1. The sync read (syncMCPServer, codermcpserver_apply.go). After a spec edit, a 404 cleared status.configID, and the create path then found the slug with a non-nonce display name. It reported SlugConflict and cleared the marker, so the config became unmanaged in Coder, possibly enabled and holding credentials. After a full apply, the same 404 gave the DeletedExternally kill switch, which also stops all writes.
2. The disable read (codermcpserver_disable.go, review thread 4269665474 on 🤖 feat: disable the CoderMCPServer config when a credential Secret withdraws consent #330). A false 404 skipped the fail-closed PATCH, so the config stayed enabled while its Secret had withdrawn consent.

This is the MCP version of #327 for CoderAIProvider. Plan gate G12, which must land before activation (M9).

Implementation

All three cases use isCoderResourceNotFound from #325: a 404 whose message is Coder's fixed resource message.

Read	Coder's own 404	Any other 404
Sync, generation applied (kill-switch case)	DeletedExternally, no write	CoderUnavailable wait, 30 s
Sync, generation not applied	clear the ID, create again	CoderUnavailable wait, 30 s, ID kept
Disable	stall: the config does not exist	the disable path's existing read-error wait (30 s, the credential reason, "Coder can still send the credentials"), ID kept

The disable read keeps its credential reason for a failed read, as CoderAIProvider does in its disable path. The organization lookup (resolveMCPServerOrganization) still treats any 404 as "organization not found". That is a wait with no state change, so it is out of scope.

Validation

New tests in internal/controller/codermcpserver_notfound_test.go, each for an HTML 404 page and for Route not found.:

• TestCoderMCPServerSyncNotCoder404: for an applied generation and after a spec edit, the reconcile waits with CoderUnavailable and a 30 s requeue, keeps status.configID and the change tokens, and sends no write. The next reconcile applies, with no second create.
• TestCoderMCPServerDisableNotCoder404: after the Secret is deleted, the disable read waits, keeps the ID, sends no write, and Coder stays enabled. The next reconcile disables.
• TestCoderMCPServerDisableCoder404: Coder's own 404 in the disable read still stalls with "does not exist in Coder" and no write. The sync read with Coder's own 404 is covered by the existing TestCoderMCPServerSyncDeletedConfig.
• Mutation checks: each of these 4 changes makes a test fail: isCoderNotFound in the applied sync case, in the unapplied sync case, or in the disable read, and a disable read that never counts a 404 as gone.
• Local gates on this head: make verify-vendor, make build, make lint, GOFLAGS=-mod=vendor go tool govulncheck ./..., make test, make test-integration, go test -race ./internal/controller/, and make docs-check pass. make codegen, make manifests, make build-installer and make docs-reference leave no diff.

Size

104 lines added and 3 removed, all hand-written: 6 changed lines in codermcpserver_apply.go, 3 in codermcpserver_disable.go, and 98 in the new tests.

Refs #155

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $165.80

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T11:45:25.301274Z	daedf3b	PR opened
🔒 Security Review	✅ Completed 2026-10-14T11:46:33.954535Z	daedf3b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: daedf3bca9

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.