VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	23 / 25	20 / 20	10 / 20	8 / 10	86 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom folder, extensions, settings, version pinning, workspace files, and offline/cached modes. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and VS Code Web, explains it installs VS Code Server in a workspace, and shows dashboard app access via coder_app.
Visual preview	5	5	README includes an embedded GIF showing VS Code Web with GitHub Copilot and live-share in action.

IDE Integration — 23 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper healthcheck, subdomain support, and configurable open_in behavior (tab or slim-window).
Managed configuration	6	6	Documented support for managed settings via settings variable with merge behavior. README shows example configuring theme and fontSize.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. Mutual exclusion enforced via precondition.
Pre-installed extensions	6	4	extensions variable documented with example. auto_install_extensions documented for .vscode/extensions.json and .code-workspace files. However, no example showing both manual and auto-install together, and auto-install requires jq (dependency not mentioned in examples).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. VS Code Server uses license acceptance only (accept_license boolean). README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Module uses --without-connection-token and --accept-server-license-terms flags. No API keys or secrets required; authentication handled by Coder's app proxy.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the download URL. The script hardcodes https://update.code.visualstudio.com/api/commits/... and https://vscode.download.prss.microsoft.com/.... commit_id pins a version but does not change the source URL.
Bring-your-own binary	5	5	offline and use_cached variables documented. When offline=true, script expects pre-installed binary at install_prefix and skips download entirely.
Egress transparency	3	3	No dedicated section, but endpoints are explicitly documented in the "Pin a specific VS Code Web version" example, which links to the Update API and GitHub Releases. Extension installation implicitly contacts marketplace but not enumerated. Scores half per rubric, but the example provides actual URLs, so awarding 3 for explicit endpoint documentation in context.
Runs without sudo	2	2	Inspected run.sh: no sudo invocations. All operations (mkdir, curl, tar, file writes) use user paths and permissions. Works as unprivileged user.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 13338, telemetry_level "error", share "owner"). Validation blocks on accept_license, share, telemetry_level, open_in, platform, and mutual exclusions (offline/use_cached, offline/extensions, workspace/folder).
Test coverage	4	2	Comprehensive TypeScript tests cover settings merge (jq, python3, fallback), JSONC stripping, auto-install from extensions.json and .code-workspace. However, .tftest.hcl only tests open_in validation—does not cover business logic like preconditions, URL construction, or extension handling.

Overall — 86 / 100

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.