feat(config): session correlation header injection configuration

[SasSwart]

PR Map

1. feat(audit): session ID generation, sequence counter, and BoundaryLog wiring #196
2. 👉🏼 feat(config): session correlation header injection configuration #197
3. feat(proxy): inject session ID and sequence number headers on matching requests #198

---

RFC: Bridge ↔ Boundaries Correlation

Add YAML and CLI configuration surface for session correlation header injection per FR 2 of the RFC.

Depends on #196.

Changes

• config/session_correlation.go: New file. Defines SessionCorrelationConfig, InjectTarget, ParseInjectTarget, ValidateSessionCorrelation, default header name constants (X-Coder-Agent-Firewall-Session-Id, X-Coder-Agent-Firewall-Sequence-Number), and DefaultInjectTargetFromEnv — a helper that derives a default inject target from CODER_AGENT_URL when no explicit targets are configured.
• config/session_correlation_test.go: New file. Table-driven tests for ParseInjectTarget, ValidateSessionCorrelation, the end-to-end NewAppConfigFromCliConfig session correlation path, DefaultInjectTargetFromEnv, and the buildSessionCorrelation CODER_AGENT_URL fallback path.
• config/config.go: Wire session correlation fields into CliConfig (five new fields for serpent bindings) and AppConfig (new SessionCorrelation field). Add buildSessionCorrelation helper that merges YAML+CLI inject targets, falls back to a target derived from CODER_AGENT_URL when none are configured and session correlation is enabled, applies header name defaults, and validates the result. The helper accepts environ []string explicitly so callers and tests can supply a controlled environment.
• cli/cli.go: Register five new serpent options and add usage examples including a zero-config workspace example.

New CLI flags

Flag	Env	YAML	Default	Description
--enable-session-correlation	BOUNDARY_SESSION_CORRELATION_ENABLED	session_correlation_enabled	false	Toggle; when enabled with no explicit targets, the inject target is auto-derived from CODER_AGENT_URL (set automatically in Coder workspaces)
--session-id-inject-target	BOUNDARY_SESSION_ID_INJECT_TARGET	—	—	Repeatable inject target (flag is repeatable; env accepts one value; use YAML for multiple). Format: domain=<host> [path=<glob>]
—	—	session_id_inject_targets	—	YAML-only list of inject targets
--session-id-header-name	BOUNDARY_SESSION_ID_HEADER_NAME	session_id_header_name	X-Coder-Agent-Firewall-Session-Id	Configurable session ID header
--sequence-number-header-name	BOUNDARY_SEQUENCE_NUMBER_HEADER_NAME	sequence_number_header_name	X-Coder-Agent-Firewall-Sequence-Number	Configurable sequence number header

Config validation ensures that when correlation is enabled at least one inject target is present (either explicit or auto-derived from CODER_AGENT_URL), and header names are non-empty. Parsing validates the domain=... path=... key-value format and rejects unknown keys.

This commit adds config and validation only; runtime injection is wired in a follow-up PR.

Note

This PR was authored by Coder Agents.