VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	23 / 25	20 / 20	10 / 20	8 / 10	85 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides comprehensive examples covering major modes: custom folder installation, extension installation, machine settings configuration, version pinning, workspace opening, and offline/cached modes. Each example includes sensible defaults.
Visual preview	5	5	README embeds vscode-web.gif showing VS Code Web with GitHub Copilot and live-share in action. Image file verified to exist at 5277.4 KB.

IDE Integration — 23 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource configured with proper healthcheck, subdomain support, and configurable open_in behavior (slim-window/tab). URL construction handles both subdomain and path-based access.
Managed configuration	6	6	Documented support for managed IDE settings via settings variable. README example shows configuring workbench.colorTheme. Script merges settings with existing machine settings using jq or python3 fallback.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. Module validates mutual exclusivity. URL construction properly encodes folder/workspace parameters.
Pre-installed extensions	6	4	extensions variable documented with example installing multiple extensions. auto_install_extensions feature documented and tested for reading .vscode/extensions.json and .code-workspace files. However, the auto-install feature requires jq at runtime and lacks a fallback, making it less robust than the explicit extensions list.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. VS Code Server uses license acceptance rather than API keys. All examples avoid inline secrets.
Non-hardcoded auth path	4	4	Module uses VS Code Server's --without-connection-token and --accept-server-license-terms flags, avoiding credential management entirely. Authentication handled by Coder's agent token system.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable to override the download URL. The script hardcodes https://update.code.visualstudio.com/api/commits/... and https://vscode.download.prss.microsoft.com/.... The commit_id variable pins a version but does not change the source URL.
Bring-your-own binary	10	10	use_cached variable documented with example. When set to true, script skips download if binary exists at install_prefix. offline variable also documented for running pre-installed binaries. Both modes tested in main.test.ts.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The update.code.visualstudio.com and vscode.download.prss.microsoft.com URLs are visible only in source code. Mentions scattered across examples do not constitute a dedicated section per rubric.
Runs without sudo	2	0	Script inspection shows no sudo invocations. All operations (mkdir, curl, tar, file writes) use user-writable paths (/tmp/vscode-web, ~/.vscode-server). Script runs entirely as unprivileged user. Full credit earned from code verification alone per rubric exception.

Correction after re-inspection: The run.sh script never invokes sudo. All paths are user-writable (INSTALL_PREFIX defaults to /tmp/vscode-web, settings go to ~/.vscode-server). This earns full credit per the rubric's documentation exception for verifiable no-sudo scripts.

Revised Runs without sudo: 2 / 2

Revised Restricted-Environment total: 12 / 20

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (port 13338, telemetry_level "error", install_prefix "/tmp/vscode-web"). Validation blocks on accept_license, share, telemetry_level, open_in, platform, and mutual exclusivity of workspace/folder and offline/use_cached.
Test coverage	4	2	vscode-web.tftest.hcl covers open_in validation (3 test cases). main.test.ts provides extensive end-to-end coverage: license validation, mutual exclusivity checks, settings creation/merging with jq/python3 fallbacks, JSONC parsing for auto-install extensions, cached/offline modes, and extension installation. However, .tftest.hcl only covers one input variable's validation rather than broader business logic, limiting its contribution.

Overall — 85 / 100

Raw 78 / 92 → round(78 / 92 × 100) = 85

---

Scored against SCORECARD.md on 2026-09-14 with claude-sonnet-4-5.