VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	22 / 25	20 / 20	7 / 20	8 / 10	82 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom folder, extensions, settings, version pinning, workspace files, and offline/cached modes. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and VS Code Web, explains it installs VS Code Server in a workspace and creates a dashboard app to access it.
Visual preview	5	5	README includes a GIF showing VS Code Web with GitHub Copilot and live-share in action.

IDE Integration — 22 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper URL construction, healthcheck, subdomain support, and configurable open_in behavior.
Managed configuration	6	6	Documented support for managed settings via the settings variable with merge behavior. README shows example configuring theme and fontSize.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. Mutual exclusion enforced via precondition.
Pre-installed extensions	6	3	Extensions can be pre-installed via extensions variable and auto_install_extensions from workspace files. However, the auto_install_extensions feature is not shown in any README example, only visible in code and tests. Half credit for under-documentation.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. VS Code Web uses license acceptance only, no API keys or secrets. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	No authentication required; VS Code Web runs without connection token as shown in run.sh. No credential path needed.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable overrides the download URL. The script hardcodes https://update.code.visualstudio.com and https://vscode.download.prss.microsoft.com. commit_id pins a version but does not change the source URL. install_prefix only changes the install location.
Bring-your-own binary	5	5	offline and use_cached variables documented with examples. When offline=true, the script expects a pre-installed binary and skips download entirely.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The URLs appear only in code (run.sh). Endpoints are inferable but not documented.
Runs without sudo	2	2	Scripts in run.sh never invoke sudo. All operations (mkdir, curl, tar, extension install) run as the agent user.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Inputs have clear descriptions, sensible defaults, and validation blocks for accept_license, share, telemetry_level, open_in, and platform. Preconditions enforce mutual exclusions.
Test coverage	4	2	TypeScript tests cover settings merge (jq, python3, fallback), JSONC stripping, auto-install extensions, and validation. However, no .tftest.hcl tests for business logic beyond basic validation checks (open_in). Half credit for incomplete .tftest.hcl coverage.

Overall — 82 / 100

---

Scored against SCORECARD.md on 2026-07-17 with claude-sonnet-4-5.