fix(enterprise): correct order for external agent init cmd (#19408)

kacpersaw · web-flow · commit c7cfa65961cc · 2025-08-19T11:00:40.000Z
### Description

`CODER_AGENT_TOKEN` env variable was incorrectly being passed to the
curl command instead of the executed script during agent initialization.

Fixed the command order to ensure `CODER_AGENT_TOKEN` is properly passed
to the script execution context rather than the download command.
diff --git a/enterprise/coderd/workspaceagents.go b/enterprise/coderd/workspaceagents.go
@@ -86,7 +86,7 @@ func (api *API) workspaceExternalAgentCredentials(rw http.ResponseWriter, r *htt
 	}
 
 	initScriptURL := fmt.Sprintf("%s/api/v2/init-script/%s/%s", api.AccessURL.String(), agent.OperatingSystem, agent.Architecture)
-	command := fmt.Sprintf("CODER_AGENT_TOKEN=%q curl -fsSL %q | sh", agent.AuthToken.String(), initScriptURL)
+	command := fmt.Sprintf("curl -fsSL %q | CODER_AGENT_TOKEN=%q sh", initScriptURL, agent.AuthToken.String())
 	if agent.OperatingSystem == "windows" {
 		command = fmt.Sprintf("$env:CODER_AGENT_TOKEN=%q; iwr -useb %q | iex", agent.AuthToken.String(), initScriptURL)
 	}
diff --git a/enterprise/coderd/workspaceagents_test.go b/enterprise/coderd/workspaceagents_test.go
@@ -385,7 +385,7 @@ func TestWorkspaceExternalAgentCredentials(t *testing.T) {
 		require.NoError(t, err)
 
 		require.Equal(t, r.AgentToken, credentials.AgentToken)
-		expectedCommand := fmt.Sprintf("CODER_AGENT_TOKEN=%q curl -fsSL \"%s/api/v2/init-script/linux/amd64\" | sh", r.AgentToken, client.URL)
+		expectedCommand := fmt.Sprintf("curl -fsSL \"%s/api/v2/init-script/linux/amd64\" | CODER_AGENT_TOKEN=%q sh", client.URL, r.AgentToken)
 		require.Equal(t, expectedCommand, credentials.Command)
 	})
 

Original file line number	Diff line number	Diff line change
`@@ -86,7 +86,7 @@ func (api API) workspaceExternalAgentCredentials(rw http.ResponseWriter, r htt`
`86`	`86`	`}`
`87`	`87`
`88`	`88`	`initScriptURL := fmt.Sprintf("%s/api/v2/init-script/%s/%s", api.AccessURL.String(), agent.OperatingSystem, agent.Architecture)`
`89`		`- command := fmt.Sprintf("CODER_AGENT_TOKEN=%q curl -fsSL %q \| sh", agent.AuthToken.String(), initScriptURL)`
	`89`	`+ command := fmt.Sprintf("curl -fsSL %q \| CODER_AGENT_TOKEN=%q sh", initScriptURL, agent.AuthToken.String())`
`90`	`90`	`if agent.OperatingSystem == "windows" {`
`91`	`91`	`command = fmt.Sprintf("$env:CODER_AGENT_TOKEN=%q; iwr -useb %q \| iex", agent.AuthToken.String(), initScriptURL)`
`92`	`92`	`}`