Mux module

[bpmct]

A discussion dedicated to the Mux module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	20 / 25	20 / 20	18 / 20	10 / 10	93 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for all major modes: basic usage, version pinning, custom package manager (npm/pnpm/bun), custom registry, cached installation, skip install, restart behavior, custom port, project opening, and arbitrary arguments. Each has sensible defaults.
Coder-context framing	8	8	README clearly states "Automatically install and run Mux in a Coder workspace," names both Coder and Mux, explains what Mux adds (parallel agentic development), and shows Coder fits in the flow via workspace integration.
Visual preview	5	5	README includes  image showing the module in action.

Agent Integration — 20 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No documentation of Coder AI Gateway or Agent Firewall support. The module generates a per-instance auth token for cross-site request protection, but this is not AI Gateway/Firewall integration.
Dashboard entry point	5	5	coder_app resource with proper healthcheck, configurable subdomain, share, order, group, and open_in settings.
Session continuity	5	5	README documents restart behavior: "Enable automatic restarts after Mux exits... The launcher waits for restart_delay_seconds, removes ~/.mux/server.lock, and starts Mux again." The restart mechanism preserves Mux's long-running processes across interruptions.
Managed configuration	5	5	README documents managed configuration via add_project (opens a project on launch), additional_arguments (arbitrary mux server arguments), port, and the module manages the auth token via MUX_SERVER_AUTH_TOKEN environment variable.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The random_password.mux_auth_token resource is used for authentication. While not explicitly marked sensitive in a variable (it's generated, not input), the token is passed via environment variable and not exposed in logs. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Module generates a per-instance auth token via random_password and passes it through environment variables (MUX_SERVER_AUTH_TOKEN) and URL query parameters, avoiding any need for users to paste raw keys.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	registry_url variable (default https://registry.npmjs.org) overrides the npm registry URL used for installation. The script uses ${REGISTRY_URL} throughout for both package manager installs and tarball downloads.
Bring-your-own binary	5	5	install = false variable documented in README: "Run without installing from the network (requires Mux to be pre-installed)." Example provided.
Egress transparency	3	1.5	README Notes section mentions "Requires internet connectivity for agent operations (unless install is set to false)" and lists the npm registry, but lacks a dedicated section enumerating all external endpoints (npm registry, nodejs.org for Node bootstrap). Endpoints are scattered across implementation details rather than consolidated.
Runs without sudo	2	2	Scripts in run.sh never invoke sudo. All operations (mkdir, curl, tar, ln, npm/pnpm/bun install) work as unprivileged user. Node bootstrap uses $HOME/.local/share/coder-mux.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port=4000, install_version="next", package_manager="auto", registry_url="https://registry.npmjs.org"). Validation blocks for package_manager (enum), share (enum), open_in (enum), restart_delay_seconds (>=0), max_restart_attempts (>=0 and whole number). Lifecycle precondition prevents use_cached with install=false.
Test coverage	4	4	.tftest.hcl covers business logic: required vars, validation failures, custom configurations, auth token presence, restart behavior, package manager selection, registry URL handling. TypeScript tests in main.test.ts cover end-to-end scenarios: default installation, tarball fallback, argument parsing, signal-based exit logging, restart after clean exit, restart after SIGTERM, npm installation.

Overall — 93 / 100

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.