VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	22 / 25	20 / 20	7 / 20	8 / 10	82 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom folder, extensions, settings, version pinning, workspace files, and offline/cached modes. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and VS Code Web, explains it installs VS Code Server in a workspace and creates a dashboard app to access it.
Visual preview	5	5	README includes a GIF showing VS Code Web with GitHub Copilot and live-share in action.

IDE Integration — 22 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper URL construction, healthcheck, subdomain support, and configurable open_in behavior.
Managed configuration	6	6	Documented support for managed settings via the settings variable with merge behavior. README shows example configuring theme and fontSize.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. Module constructs appropriate URL query parameters.
Pre-installed extensions	6	3	extensions variable documented with example. auto_install_extensions documented for workspace recommendations. However, no example showing both mechanisms together, and auto-install requires jq (dependency not mentioned in examples).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	VS Code Server uses --without-connection-token and relies on Coder's authentication. No keys or tokens required.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the download URL. The script hardcodes https://update.code.visualstudio.com and https://vscode.download.prss.microsoft.com. commit_id pins a version but does not change the source URL.
Bring-your-own binary	5	5	offline and use_cached variables documented. When offline=true, script expects pre-installed binary at install_prefix and skips download entirely.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. URLs appear in code but are not documented for restricted environments.
Runs without sudo	2	2	Scripts in run.sh never invoke sudo. All operations (mkdir, curl, tar, file writes) work as unprivileged user.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Inputs have clear descriptions, sensible defaults, and validation blocks for accept_license, share, telemetry_level, open_in, platform, and mutual exclusivity preconditions.
Test coverage	4	2	TypeScript tests cover settings merge (jq/python3 fallbacks), JSONC stripping, and auto-install extensions. .tftest.hcl covers only open_in validation. Business logic like URL construction, preconditions, and extension handling not covered in Terraform tests.

Overall — 82 / 100

---

Scored against SCORECARD.md on 2026-07-20 with claude-sonnet-4-5.