feat: add --chat-hook-allow-insecure to allow plain HTTP chat hook URLs - #27896

@codex review

Docs preview

Check off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here.

• docs/admin/setup/chat-lifecycle-hooks.md
• docs/reference/api/general.md
• docs/reference/api/schemas.md

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 72573e68b0

Security review of 72573e6 — no vulnerability in the default path; the flag is a reasonable opt-in trade-off. Notes:

Done well

• Default-off, hidden; both enforcement points (DeploymentValues.Validate() and validateHookURL) relaxed consistently and only for scheme http. Non-http(s) schemes, hostless/fragment/userinfo rejection, secret and timeout checks unchanged, with test coverage at both points.
• Scoped to scheme only — no impact on TLS verification for https URLs.
• Redirects stay disabled, and JWT claims (aud = exact URL, jti, body SHA-256, ~≤35s expiry) limit token-theft/replay impact.

Suggestions

1. The warning text undersells the main risk. Hook responses are unauthenticated and control execution: on an untrusted network an on-path attacker can flip deny→allow, inject input_override (rewriting prompts/tool inputs), or inject model_context — active integrity compromise of the agent-control channel, not just data/token exposure. Recommend the flag description and docs say responses can be forged.
2. Consider a startup Warn log when the flag is set with an http URL, so the insecure mode is visible at runtime.
3. Pre-existing, not from this PR: Validate() rejects loopback http while the dispatcher allows it, so the loopback carve-out is only reachable where startup validation doesn't run.

Thanks for the review. Addressed the non-blocking suggestions in 779e11f and 31b466d:

1. The flag description and the docs now state the real risk: plain HTTP lets an on-path attacker forge hook responses, which allow/deny tool calls and can rewrite prompts and tool inputs.
2. coder server now logs a startup warning when hooks are active over a plain http URL, with the hook URL redacted (userinfo/query stripped) in the log field.
3. Left as-is per your note: the loopback carve-out asymmetry between Validate() and the dispatcher predates this PR.

Mux acted on Mike's behalf to post this comment.

@codex review

@codex review

@codex review

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 8bf7fec9f1