VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	22 / 25	20 / 20	7 / 20	8 / 10	82 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom folder install, extension installation, settings configuration, version pinning, workspace opening. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and VS Code, explains it installs VS Code Server in a workspace and creates a dashboard app to access it. Shows Coder fits as the orchestration layer.
Visual preview	5	5	README includes a GIF showing VS Code Web with GitHub Copilot and live-share in action.

IDE Integration — 22 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper healthcheck, configurable subdomain, share, order, group, and open_in behavior.
Managed configuration	6	6	Documented settings variable with example showing Machine settings.json configuration. Merges with existing settings using jq or python3.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. Folder opens a directory, workspace opens a .code-workspace file. Validation ensures only one is set.
Pre-installed extensions	6	3	extensions variable documented with example. auto_install_extensions documented for .vscode/extensions.json and .code-workspace recommendations. However, no example showing both mechanisms together, and auto-install requires jq which may not be present.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. VS Code Server uses license acceptance boolean, not API keys. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Module uses VS Code Server's built-in license acceptance mechanism (--accept-server-license-terms). No API keys or tokens required.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the download URL. The script hardcodes https://update.code.visualstudio.com/api/commits/... and https://vscode.download.prss.microsoft.com/.... commit_id pins a version but does not change the source URL.
Bring-your-own binary	5	5	offline and use_cached variables documented. When offline=true, script expects VS Code Web already present at install_prefix and skips download entirely.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are inferable from code (update.code.visualstudio.com, vscode.download.prss.microsoft.com) but not documented.
Runs without sudo	2	2	Inspected run.sh: no sudo invocations. All operations (mkdir, curl, tar, file writes) work as unprivileged user.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 13338, telemetry_level "error", share "owner"). Validation on accept_license, share, telemetry_level, open_in, platform, and mutual exclusivity of offline/use_cached and workspace/folder.
Test coverage	4	2	.tftest.hcl covers open_in validation. TypeScript tests cover settings merging (jq, python3, fallback), extension installation, JSONC parsing, and auto-install from extensions.json and .code-workspace. However, no tests for offline mode, commit_id pinning, or platform detection.

Overall — 82 / 100

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.