Skip to content

feat: add core AI MITM proxy daemon#21296

Merged
ssncferreira merged 8 commits intomainfrom
ssncferreira/feat-add-aiproxy-core
Dec 29, 2025
Merged

feat: add core AI MITM proxy daemon#21296
ssncferreira merged 8 commits intomainfrom
ssncferreira/feat-add-aiproxy-core

Conversation

@ssncferreira
Copy link
Contributor

@ssncferreira ssncferreira commented Dec 16, 2025 •
edited
Loading

Description

Adds the core AI Bridge MITM proxy daemon. This proxy intercepts HTTPS traffic, decrypts it using a configured CA certificate, and forwards requests to AIBridge for processing.

Changes

  • Added aibridgeproxyd package with the core proxy server implementation
  • Added configuration options: CODER_AIBRIDGE_PROXY_ENABLED, CODER_AIBRIDGE_PROXY_LISTEN_ADDR, CODER_AIBRIDGE_PROXY_CERT_FILE, CODER_AIBRIDGE_PROXY_KEY_FILE
  • Added tests for server initialization and MITM functionality

Closes coder/internal#1180

@ssncferreira Graphite App
Copy link
Contributor Author

ssncferreira commented Dec 16, 2025 •
edited by dannykopping
Loading

This stack of pull requests is managed by Graphite. Learn more about stacking.

@ssncferreira ssncferreira force-pushed the ssncferreira/feat-add-aiproxy-core branch 2 times, most recently from f095630 to a6abd82 Compare December 16, 2025 20:50
ssncferreira
ssncferreira commented Dec 16, 2025
View reviewed changes
ssncferreira
ssncferreira commented Dec 16, 2025
View reviewed changes
ssncferreira
ssncferreira commented Dec 16, 2025
View reviewed changes
dannykopping
dannykopping reviewed Dec 17, 2025
View reviewed changes
Copy link
Contributor

@dannykopping dannykopping left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good 👍

Needs some basic test coverage please, and the renaming that we discussed offline.

@ssncferreira ssncferreira force-pushed the ssncferreira/feat-add-aiproxy-core branch from cbbdad6 to 637bf69 Compare December 17, 2025 13:37
@ssncferreira ssncferreira mentioned this pull request Dec 17, 2025
Closed
@ssncferreira ssncferreira force-pushed the ssncferreira/feat-add-aiproxy-core branch from 637bf69 to c90790f Compare December 17, 2025 17:16
dannykopping
dannykopping approved these changes Dec 17, 2025
View reviewed changes
Copy link
Contributor

@dannykopping dannykopping left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ssncferreira ssncferreira force-pushed the ssncferreira/feat-add-aiproxy-core branch 3 times, most recently from 5a6ab75 to fdd4a44 Compare December 19, 2025 17:50
@ssncferreira ssncferreira mentioned this pull request Dec 19, 2025
Merged
@ssncferreira ssncferreira force-pushed the ssncferreira/feat-add-aiproxy-core branch 2 times, most recently from e4d1ca1 to ca7e3a6 Compare December 19, 2025 19:09
@ssncferreira
Copy link
Contributor Author

ssncferreira commented Dec 19, 2025

Currently, tests are flaky because of multiple test calls to aibridgeproxyd.New() in parallel, and each loads a different CA certificate into goproxy.GoproxyCa, which is a global variable. When one test overwrites the CA while another test is making a request, TLS verification fails because the client trusts a different CA than the one goproxy is using to sign certificates:

Get "https://127.0.0.1:45849/": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Test CA")

A possible fix would be to use a shared global CA for all tests so they don't overwrite each other.

This was referenced Dec 19, 2025
Merged
Merged
@ssncferreira ssncferreira marked this pull request as ready for review December 19, 2025 22:40
@ssncferreira
Copy link
Contributor Author

ssncferreira commented Dec 23, 2025 •
edited
Loading

Currently, tests are flaky because of multiple test calls to aibridgeproxyd.New() in parallel, and each loads a different CA certificate into goproxy.GoproxyCa, which is a global variable. When one test overwrites the CA while another test is making a request, TLS verification fails because the client trusts a different CA than the one goproxy is using to sign certificates:

Get "https://127.0.0.1:45849/": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Test CA")

A possible fix would be to use a shared global CA for all tests so they don't overwrite each other.

Fixed by wrapping loadMitmCertificate in sync.Once to ensure goproxy.GoproxyCa (a package-level global) is only written once, avoiding the race condition when multiple proxy servers start concurrently in tests. Also added getSharedTestCA(t) which uses sync.Once to generate the CA once and share it across all tests. Addressed in: 206d7fc

@ssncferreira ssncferreira force-pushed the ssncferreira/feat-add-aiproxy-core branch 4 times, most recently from 206d7fc to fa9f710 Compare December 23, 2025 22:43
dannykopping
dannykopping reviewed Dec 24, 2025
View reviewed changes
This was referenced Dec 29, 2025
Merged
Merged
@dannykopping dannykopping force-pushed the ssncferreira/feat-add-aiproxy-core branch from fa9f710 to 1134e49 Compare December 29, 2025 09:04
@ssncferreira ssncferreira force-pushed the ssncferreira/feat-add-aiproxy-core branch from 1134e49 to 910edbc Compare December 29, 2025 10:38
@ssncferreira Graphite App
Copy link
Contributor Author

ssncferreira commented Dec 29, 2025 •
edited
Loading

Merge activity

  • Dec 29, 3:31 PM UTC: A user started a stack merge that includes this pull request via Graphite.
  • Dec 29, 3:31 PM UTC: @ssncferreira merged this pull request with Graphite.

@ssncferreira ssncferreira merged commit b975722 into main Dec 29, 2025
29 checks passed
@ssncferreira ssncferreira deleted the ssncferreira/feat-add-aiproxy-core branch December 29, 2025 15:31
noeljackson added a commit to noeljackson/coder that referenced this pull request Jan 4, 2026
@noeljackson
Merge upstream coder/coder main
68b249e 
* upstream/main:
  docs: update VS Code Web subpath comment to reflect current support (coder#21375)
  feat: add boundary log forwarding from agent to coderd (coder#21345)
  chore: add airflow icon (coder#21401)
  refactor: add aiproxy test helpers to reduce boilerplate (coder#21404)
  chore: bump github.com/zclconf/go-cty-yaml from 1.1.0 to 1.2.0 (coder#21366)
  perf: increase bridge pool cache size limit (coder#21399)
  feat: add API to serve proxy certificate (coder#21391)
  chore: remove experimental endpoints (coder#21390)
  feat: add certificate caching for AI Bridge Proxy (coder#21344)
  feat: reroute AI provider requests to aibridged (coder#21343)
  feat: add proxy authorization to aibridgeproxyd (coder#21342)
  feat: add core AI MITM proxy daemon (coder#21296)
  test: use deterministic time to avoid time-based flake (coder#21396)
  ci: bump the github-actions group with 3 updates (coder#21394)
  chore: bump google.golang.org/grpc from 1.77.0 to 1.78.0 (coder#21393)
  chore: bump github.com/brianvoe/gofakeit/v7 from 7.12.1 to 7.14.0 (coder#21392)
  feat(dogfood): use coder exp sync to synchronize scripts (coder#21384)
  chore: bump the coder-modules group across 3 directories with 4 updates (coder#21388)
  chore: add playwright MCP in proper place
  feat(coderd): support deleting dev containers (coder#21248)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dannykopping dannykopping dannykopping approved these changes

Assignees

@ssncferreira ssncferreira

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

aibridge: implement core MITM proxy

2 participants

@ssncferreira @dannykopping