feat(coderd_chat_system_prompt): manage the deployment-wide chat system prompt

[bpmct]

Closes #411

Note

Draft until coder/coder#28283 is approved (exports the sanitizer as codersdk.SanitizePromptText). Depending on timing, either the mirrored chat_system_prompt_sanitize.go gets swapped for the codersdk function here, or the swap lands as the agreed follow-up with the next SDK bump.

Problem

The deployment-wide chat system prompt (Settings → Instructions, GET/PUT /api/experimental/chats/config/system-prompt) has no provider resource, so managing it as code means curling the API from CI — which is exactly what coder/dogfood does for cdrstable.dev today, with a hand-rolled drift-diff step in the plan job (coder/dogfood#400). It's one of the most frequently-changing pieces of agents config and should be codified like the AI providers and models already are.

What

A new coderd_chat_system_prompt singleton resource:

resource "coderd_chat_system_prompt" "this" {
  system_prompt                  = file("${path.module}/system-prompt.md")
  include_default_system_prompt = true
}

Design notes:

• Sanitization-aware drift: coderd sanitizes the stored prompt (strips invisible Unicode chars, normalizes CRLF, collapses blank-line runs, trims). system_prompt is a custom string type whose semantic equality compares sanitized forms — same approach as coderd_agents_model.model_config's normalized JSON — so the trailing newline from file(...) doesn't cause drift after apply, while real edits still diff. The sanitizer is a straight port of chatd.SanitizePromptText; if upstream changes it, the failure mode is a visible diff, not silent drift. (Framework semantic equality can't rewrite the planned value of a Required attribute, so the first plan after an import shows a one-time normalization update when the config differs only by sanitization; documented, with trimspace(file(...)) as the escape hatch.)
• Singleton semantics follow coderd_oauth2_provider_settings: create/update share one idempotent PUT, terraform destroy resets the never-configured defaults (empty prompt, include_default_system_prompt = true; the API has no DELETE), import adopts the live value without writing, and a plan-time warning fires when a first apply is about to overwrite a non-empty out-of-band prompt or flip include_default_system_prompt away from the live value.
• Plan-time length validation against coderd's 128 KiB cap, same idea as fix(coderd_template): validate description length at plan time #404.
• 404 → version hint: the endpoint shipped in Coder v2.32.0 (fix(agents): persist system prompt server-side instead of localStorage coder#22857); older deployments get an actionable error instead of a bare not-found.
• Experimental warning like the other agents resources; the include-default pointer is always sent so the resource owns the value outright.

Testing

• Real-Coder acceptance tests (integration.StartCoder, TF_ACC-gated, no license needed — the endpoint has no entitlement check): the no-drift test is the live proof the sanitizer port matches the server — the applied prompt carries a CRLF, a zero-width space, a blank-line run, and a trailing newline, and the re-plan must be empty; destroy is verified via the API to reset the deployment defaults. The import test pins both convergence behaviors (byte-matching config plans clean; sanitization-only difference applies one normalization update, then converges).
• Fake-coderd tests in the oauth2_provider_settings style for assertions about requests made and not made: import issues no PUT, destroy resets defaults, the 404 version hint.
• Unit tests for the sanitizer port (ZWNJ preserved, ZWJ stripped, idempotency), the semantic-equality matrix, the plan-time length validator, and a ModifyPlan table test covering the create-time overwrite advisories for both attributes.

make gen docs included; lint clean on the CI's golangci-lint v2.8.0; full package suite passes with and without TF_ACC.

Follow-ups

• Swap the mirrored sanitizer for codersdk.SanitizePromptText once refactor: move chat prompt sanitization into codersdk coder#28283 is in the pinned SDK.
• The sibling plan-mode-instructions endpoint could get the same treatment; left out to keep this reviewable.
• Once released, coder/dogfood can drop the workflow PUT + drift steps in coderd-stable/ and fold system-prompt.md into the ai/ module (docs: add "Manage the system prompt as code" recipe under ai-coder/agents/platform-controls/ coder#28090 tracks documenting the recipe).

Generated by Coder Agents on behalf of @bpmct

[ethanndickson]

Instead of mirroring code from coder/coder, we should just export it as part of codersdk, and then we can just import it. I don't want to introduce drift.

If we desperately want to get this resource in ASAP, I'm happy for this to be done as a followup.

Feel free to ping me for review on the coder/coder PR.

[bpmct]

Agreed on not mirroring — opened coder/coder#28283 exporting it as codersdk.SanitizePromptText (pure move + callsite updates, tests move with it) and requested you as reviewer.

For this PR I kept the local copy with a TODO pointing at that PR, since actually importing it requires bumping the pinned coder/coder here, and each dep bump is coupled to a release's model_config schema. So the swap lands as the follow-up you suggested: once 28283 merges and the next SDK bump happens, chat_system_prompt_sanitize.go gets deleted and the resource calls the codersdk function directly. The real-Coder acceptance test (applies a prompt with CRLF + zero-width space + blank-line run and requires an empty re-plan) is what keeps the copy honest in the meantime — if the server's sanitizer changes, that test breaks.

Generated by Coder Agents on behalf of @bpmct

[bpmct]

coder/coder#28283