VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	25 / 25	20 / 20	7 / 20	10 / 10	86 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents six distinct modes: default install, custom folder, extensions, machine settings, version pinning via commit_id, and workspace file. Each example uses sensible defaults and covers the major configuration axes of the module.
Visual preview	5	5	README embeds ; file verified to exist at 5,277 KB.

IDE Integration — 25 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with slug, display_name, subdomain, share, order, group, open_in, and a healthcheck block. README states the module "create[s] an app to access it via the dashboard."
Managed configuration	6	6	settings variable merges into Machine settings.json (documented with a "Pre-configure Machine Settings" example). extensions, auto_install_extensions, and disable_trust provide further managed-configuration surface.
Configurable folder or workdir	6	6	folder and workspace variables are documented with dedicated README examples ("Install VS Code Web to a custom folder" and "Open an existing workspace on startup"). Precondition enforces mutual exclusivity.
Pre-installed extensions	6	6	extensions list variable with a README example (["github.copilot", "ms-python.python", "ms-toolsai.jupyter"]). auto_install_extensions reads recommendations from .vscode/extensions.json or .code-workspace files. Both paths are exercised in tests.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No variable in main.tf carries a credential, token, or API key. The script launches with --without-connection-token, so no secret is ever passed. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	The module requires no user-supplied key or token. Access is mediated entirely by Coder's app authentication (subdomain/path routing + workspace auth). No raw-key path exists to avoid.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	Download URLs are hardcoded in run.sh (update.code.visualstudio.com and vscode.download.prss.microsoft.com). No module input variable overrides the base download URL. commit_id pins a version but does not change the host; install_prefix controls install location, not source.
Bring-your-own binary	10	5	use_cached and offline variables skip the download when a binary already exists at install_prefix. Both are implemented in run.sh and have Terraform variable descriptions, but the README contains no example or section demonstrating pre-baked / air-gapped usage.
Egress transparency	3	0	No dedicated README section enumerates the external endpoints (update.code.visualstudio.com, vscode.download.prss.microsoft.com, extension registry). Endpoints are visible only in run.sh source.
Runs without sudo	2	2	run.sh never invokes sudo. Default install_prefix is /tmp/vscode-web (user-writable). All operations (mkdir, curl, tar, extension install, server launch) run as the invoking user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 22 variables carry descriptions and sensible defaults. Enum-like variables (share, telemetry_level, open_in, platform) have validation blocks. accept_license enforces true. settings is typed any (acceptable for JSON). Minor: order/group default to null rather than a typed sentinel, but this is a Coder-provider convention.
Test coverage	4	4	main.test.ts (12 test cases) covers end-to-end behavior: settings creation/merge/fallback, JSONC stripping, extension install paths, cached/offline modes, and mutual-exclusion preconditions. vscode-web.tftest.hcl validates open_in default, custom, and invalid values. Clear testing story with TypeScript as the primary E2E layer.

Overall — 86 / 100

Raw 79 / 92 → round(79 / 92 × 100) = 86

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.