Claude Code module

[bpmct]

A discussion dedicated to the Claude Code module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	15 / 25	12 / 20	13.5 / 20	10 / 10	68 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Extensive, well-organized examples for every major mode: standalone API key, Claude.ai OAuth, AI Gateway (enable_ai_gateway), managed-settings auth, Bedrock (use_bedrock), Vertex (use_vertex), Foundry (use_foundry), custom gateway (anthropic_base_url), api_key_helper, telemetry, and coder_app launcher — each with sensible defaults and prose explaining when to use it.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	5	AI Gateway is documented in depth (enable_ai_gateway, authentication_config, session-token auth). Agent Firewall/Boundary support is explicitly called out as dropped in v5 ("v5 ... drops support for ... Boundary ... We plan to add Boundary support back in a follow-up"), which per calibration counts as absent. Only one of the two governance paths is documented → half.
Dashboard entry point	5	5	"Standalone mode with a launcher app" example shows a full coder_app resource with open_in = "slim-window" and a command that launches claude.
Session continuity	5	0	No documentation of resuming sessions, session IDs, or a persistent session manager (tmux/screen/boo). The coder exp sync example is about script ordering, not session continuity.
Managed configuration	5	5	managed_settings writes an enterprise policy file with highest precedence; mcp / mcp_config_remote_path configure MCP servers; workdir configures working directory. All thoroughly documented with examples.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	anthropic_api_key, claude_code_oauth_token, foundry_api_key, foundry_auth_token are all declared sensitive = true. However, nearly every README example inlines a placeholder secret (anthropic_api_key = "xxxx-xxxxx-xxxx"), which per calibration caps this at half regardless of the sensitive flags.
Non-hardcoded auth path	4	4	Multiple non-hardcoded paths documented: AI Gateway session-token auth, AWS credential chain (IRSA/instance profile) for Bedrock, Google ADC/Workload Identity for Vertex, Azure default credential chain for Foundry, and api_key_helper for Vault/Secrets Manager.

Restricted-Environment Readiness — 13.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The installer is fetched from a hardcoded https://claude.ai/install.sh in scripts/install.sh.tftpl with no variable overriding this URL. claude_code_version only changes the version argument passed to the installer, not the download source. No qualifying variable exists.
Bring-your-own binary	10	10	install_claude_code = false combined with claude_binary_path lets the module skip installation entirely and validate a pre-baked binary; documented in the "Advanced Configuration" example and enforced via a validation block.
Egress transparency	3	1.5	No dedicated network/offline/air-gapped section. Endpoints (claude.ai/install.sh, Anthropic API, Bedrock, Vertex, Foundry, AI Gateway) are only mentioned scattered across unrelated mode-specific examples → half per calibration rule.
Runs without sudo	2	2	Core install (install_with_official_installer, configure_claude_binary) never calls sudo. write_managed_settings/setup_api_key_helper/remove_managed_file check command_exists sudo and fall back to direct (non-root) writes when sudo is absent — graceful, functional fallback, verified in code.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions and sensible defaults; extensive validation blocks enforce mutual exclusivity across use_bedrock/use_vertex/use_foundry/enable_ai_gateway/anthropic_base_url/api_key_helper/claude_binary_path.
Test coverage	4	4	main.tftest.hcl covers business logic (auth precedence, env var wiring, validation failures) extensively; main.test.ts provides real container-based end-to-end coverage of install, MCP config, managed settings, cleanup, and auth scenarios.

Overall — 68 / 100

Raw 62.5 / 92 → round(62.5 / 92 × 100) = 68

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.