feat(proxy): inject session ID and sequence number headers on matching requests

[SasSwart]

PR Map

1. feat(audit): session ID generation, sequence counter, and BoundaryLog wiring #196
2. feat(config): session correlation header injection configuration #197
3. 👉🏼 feat(proxy): inject session ID and sequence number headers on matching requests #198

---

RFC: Bridge ↔ Boundaries Correlation

When session correlation is enabled and the outgoing request matches a configured inject target, set X-Coder-Agent-Firewall-Session-Id and X-Coder-Agent-Firewall-Sequence-Number headers on the forwarded request. Any values the jailed client may have set are overwritten so the upstream always sees boundary's authoritative session ID and sequence number.

Depends on #197.

Changes

• audit/request.go: Add SequenceNumber int32 field to Request. The proxy assigns this value before auditing so the audit log and the injected HTTP header carry the same sequence number.
• audit/socket_auditor.go: Remove the seq *SequenceCounter field. The auditor now reads req.SequenceNumber directly instead of generating its own value. NewSocketAuditor no longer accepts a *SequenceCounter parameter.
• audit/multi_auditor.go: Remove SequenceCounter creation in SetupAuditor; call NewSocketAuditor with three arguments (logger, socket path, session ID).
• audit/socket_auditor_test.go: Remove seq field from test auditor structs. Tests that exercise sequence numbers now set SequenceNumber on the Request directly.
• cli/cli.go: Minor punctuation fix in the --session-id-inject-target flag description.
• proxy/proxy.go:
  • Add sessionCorrelation, sessionID, seqCounter, forwardTransport fields to Server.
  • Add SessionCorrelation, SessionID, ForwardTransport to Config (the sequence counter is an internal value-type field on Server, not user-configurable).
  • New shouldInjectHeaders(host, path) method: matches request host (case-insensitive, port-stripped) and optional path glob against configured InjectTargets.
  • processHTTPRequest allocates a sequence number from p.seqCounter and passes it to both AuditRequest and forwardRequest.
  • forwardRequest stamps both headers on matching requests after copying client headers (overwriting any client-supplied values). Uses ForwardTransport when set.
• proxy/proxy_audit_test.go: New test TestSequenceNumberIncrementsAcrossRequestTypes — verifies sequence numbers increment correctly across plain HTTP, implicit-CONNECT HTTPS, and explicit-CONNECT tunnel requests.
• proxy/proxy_framework_test.go: Add WithSessionCorrelation, WithSessionID, WithForwardTransport test options; wire them into the proxy Config.
• proxy/proxy_session_correlation_test.go: New test file with seven tests:
  • TestSessionCorrelation_MatchedDomain: headers injected on matching domain.
  • TestSessionCorrelation_MatchedDomainWithPort: headers injected when inject target domain includes a port.
  • TestSessionCorrelation_UnmatchedDomain: headers absent on non-matching domain.
  • TestSessionCorrelation_Disabled: headers absent when correlation is disabled.
  • TestSessionCorrelation_OverwritesClientValue: proxy overwrites spoofed client headers.
  • TestSessionCorrelation_PathMatching: headers injected only when path glob matches.
  • TestSessionCorrelation_SequenceNumberIncrements: sequence numbers increment across requests.

Implementation notes

• The sequence number is allocated once in processHTTPRequest via p.seqCounter.Next(), then threaded through to both the auditor and the header injection site. This guarantees the audit event and the HTTP header always agree on the sequence number for a given request.
• shouldInjectHeaders strips the port from both the request host and the configured target domain using net.SplitHostPort before comparison, and uses path.Match for glob matching, consistent with the RFC's path=/api/v2/aibridge/* syntax.
• The SequenceCounter on Server is a value type (audit.SequenceCounter) backed by an atomic.Int32. It is always present and starts at 0 — sequence numbers are allocated for every request regardless of whether session correlation is enabled.

Note

This PR was authored by Coder Agents.

[SasSwart]

I've self-reviewed this agent generated PR. Apart from double-checking TestSequenceNumberIncrementsAcrossRequestTypes, I can vouch for everything in this PR. Its ready for external review.