fix: error on CLI HTTP redirects instead of following them - #29104

Problem

codersdk.Client uses an http.Client with no CheckRedirect, so Go's default applies: a 301/302/303 is followed by downgrading the request to a GET with no body. When ~/.config/coderv2/url points at a stale host that redirects to the new deployment, coder tokens create silently becomes a GET /api/v2/users/{user}/keys/tokens (the list endpoint, same path) and fails with:

error: create tokens: json: cannot unmarshal array into Go value of type codersdk.GenerateAPIKeyResponse

Fix

Set CheckRedirect on the HTTP client built in cli/root.go (createHTTPClient, used by every CLI command including coder login) to refuse redirects and return a typed redirectError. The CLI error formatter prints the original and target URLs plus a suggestion to run coder login <new URL> when the redirect changes host or scheme, or a proxy/path-rewrite hint when it stays within the same deployment.

Encountered an error running "coder tokens create", see "coder tokens create --help" for more information
error: Trace=[get token config: Get "https://dogfood.cdr.dev/api/v2/users/me/keys/tokens/tokenconfig": ]
server redirected request from https://dev.coder.com/api/v2/users/me/keys/tokens/tokenconfig to https://dogfood.cdr.dev/api/v2/users/me/keys/tokens/tokenconfig
Suggestion: The deployment URL may have changed. Run "coder login https://dogfood.cdr.dev" to log in against the new URL, or pass --allow-redirects to follow redirects.

The codersdk.New default http.Client is intentionally left unchanged to avoid altering behavior for agents, provisioner daemons, and external SDK consumers.

Breaking change

The CLI previously followed redirects silently. Any workflow that depended on that, for example a stale URL config that "worked" through a host redirect, or an http-to-https redirect in front of a deployment, will now fail with the error above until the stored URL is updated with coder login.

To keep the old behavior, opt in with the new global flag --allow-redirects or CODER_ALLOW_REDIRECTS=true. The flag help text notes that following redirects may alter the request method or drop its body, so this is a compatibility escape hatch rather than a recommended setting.

Tests

• Test_createHTTPClientRedirects/RejectedByDefault: a stale server redirects to a target serving [] on GET; asserts CreateToken fails with *redirectError carrying the correct URLs and that the formatted output includes the login suggestion and the flag name.
• Test_createHTTPClientRedirects/AllowRedirects: with allowRedirects set, GET requests follow the redirect successfully and the POST reproduces the legacy downgrade behavior without a redirectError.
• Test_redirectErrorHelper: host change, http-to-https upgrade, and same-deployment cases.

Golden help files and docs/reference/cli/index.md regenerated with make gen.

Generated by Coder Agents on behalf of @f0ssel.