server/coder: working-tree backend changes (pre-existing)

Checkpoint of in-progress backend work present in the tree, not authored this session: auto_name, inference tool-phase/turn, secret_guard, provider-registry, plus a new agent-allowlist test (7 tests, passing).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/server/src/services/auto_name.ts

@@ -45,22 +45,26 @@ export async function maybeAutoNameChat(
   if (!chat) return;
   if (chat.name !== null && chat.name !== '') return;
 
-  const assistantMsg = await ctx.sql<{ content: string }[]>`
-    SELECT content FROM messages
+  const firstMsgs = await ctx.sql<{ role: string; content: string }[]>`
+    SELECT role, content FROM messages
     WHERE chat_id = ${chatId}
-      AND role = 'assistant'
-      AND status = 'complete'
+      AND role IN ('user', 'assistant')
+      AND status IN ('complete', 'ok')
       AND content <> ''
     ORDER BY created_at ASC
-    LIMIT 1
+    LIMIT 2
   `;
-  if (!assistantMsg[0]) return;
+  const userMsg = firstMsgs.find(m => m.role === 'user');
+  const assistantMsg = firstMsgs.find(m => m.role === 'assistant');
+  if (!assistantMsg) return;
 
-  const assistantText = assistantMsg[0].content.slice(0, 2000);
+  let namingInput = '';
+  if (userMsg) namingInput += `User: ${userMsg.content.slice(0, 1000)}\n\n`;
+  namingInput += `Assistant: ${assistantMsg.content.slice(0, 1000)}`;
 
   const raw = await taskModelCompletion({
     system: NAMING_SYSTEM_PROMPT,
-    user: assistantText,
+    user: namingInput,
     maxTokens: 30,
     temperature: 0.3,
   });