[35C4n0r]

Closes REG-82

Refactor coder-labs/auggie to install and configure Auggie CLI only, matching the claude-code, codex, copilot, cursor-cli, opencode, and kiro-cli migrations. Changes beyond the AgentAPI removal are limited to what the current Auggie docs require.

• Replace the agentapi module with coder-utils; drop Tasks/web-app inputs (order, group, install_agentapi, agentapi_version, ai_prompt, report_tasks, cli_app, web_app_display_name, cli_app_display_name, continue_previous_conversation, interaction_mode), the task_app_id output, the start script, and the task-reporting coder MCP server.
• folder is renamed to workdir, optional, and created if missing.
• Install stays on the documented npm install -g @augmentcode/auggie (into ~/.npm-global, as before), now on every start when install_auggie = true; with false, auggie must be on PATH. Removed the auggie_version validation; it is base64-encoded into the script.
• mcp and mcp_files are added to ~/.augment/settings.json with auggie mcp add-json at install time instead of --mcp-config flags at launch. Existing names are kept with a per-name warning, matching the CLI without --replace.
• rules are written to the user rules folder (~/.augment/rules/coder-module.md) instead of a --rules flag. auggie_model sets the model key in ~/.augment/settings.json instead of --model.
• augment_session_token is now sensitive and AUGMENT_SESSION_AUTH is only created when set; it was previously also rendered into the start script.
• Add scripts output; README reduced to examples and doc links; rewrite tests. Bump to 1.0.0.

Important

Model calls and MCP connections were not verified: they need an Augment account, which was not available.

Decision log

Topic	Auggie CLI reality (docs, verified on 0.36.0)	Decision
Install	Only documented method is npm install -g @augmentcode/auggie, Node 20+	Keep npm with the existing ~/.npm-global prefix (keeps auggie upgrade writable); keep the node/npm check and .bashrc sourcing
Version	npm tags; interactive mode auto-updates unless disabled	Pass straight to npm; README links the auto-update docs instead of adding a new input
Auth	AUGMENT_SESSION_AUTH env var with the auggie token print JSON	coder_env only, gated on non-empty, never in scripts or logs
MCP	~/.augment/settings.json mcpServers; auggie mcp add-json works without login, preserves JSONC, and non-interactively exits 3 with "already exists" unless --replace	Use auggie mcp add-json; existing servers win with a warning; no jq edit of MCP
Rules	--rules flag, or auto-loaded ~/.augment/rules/*.md (always applied)	Write rules to ~/.augment/rules/coder-module.md; auggie rules list shows it
Model	Docs show --model//model; settings schema has model, and with it set auggie logs Ignoring --model=<value> when no models are available	Keep auggie_model by writing model with jq; a JSONC settings file is left unchanged with a warning
Workdir	No trust file; indexing confirmation is a launch flag (--allow-indexing)	Create only
Validations	auggie_version and interaction_mode had them	Removed

Testing

• terraform test (6 passed), bun test main.test.ts (12 passed, container-based), terraform fmt, terraform validate, prettier, shellcheck on the rendered script (all severities)
• Real Auggie in codercom/enterprise-node:latest via the module's rendered pre_install and install scripts:
  • pinned 0.35.0 installed, CODER_SCRIPT_BIN_DIR symlink and profile PATH entries created
  • pre_install seeded settings kept (theme, user shared server wins with a warning); everything and mcp_files server added; auggie mcp list shows all three
  • auggie rules list shows ~/.augment/rules/coder-module.md; the model key is picked up (Ignoring --model=test-model because no model options are available without login)
  • rerun is idempotent (no duplicate profile lines, settings unchanged); switching to latest installs 0.36.0
  • token only in AUGMENT_SESSION_AUTH (dummy token gets a 401 from Augment), absent from scripts, logs, and ~/.augment; rotated value applied
• Dogfood workspace from a test template: Auggie 0.36.0 installed and linked into CODER_SCRIPT_BIN_DIR, downstream coder exp sync script ran after pre_install, install, post_install; seeded settings kept, user shared server kept with a warning, everything and mcp_files servers added, model set, rules written, AUGMENT_SESSION_AUTH set
• Verified auggie --help, auggie mcp --help, and duplicate auggie mcp add-json behavior (exit 3, existing entry and JSONC kept) on 0.36.0

---

Generated with Coder Agents.

[linear-code]

REG-82

[github-actions]

Module Scorecard Check

coder-labs/auggie: first scorecard, 63 / 100

No specific score is required to contribute, but modules with higher scores are more likely to be approved by the Coder team and widely used.

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
10 / 17	13 / 25	20 / 20	7 / 20	8 / 10	63 / 100

Drilldown

Presentation & Onboarding — 10 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	10	Five distinct examples cover default install, standalone with launcher app (workdir + coder_app), MCP/rules, pinned version, and downstream coder_script serialization. The install_auggie = false (BYO binary) mode is described in the variable but has no dedicated README example.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field references an SVG but that is not a visual preview of the module in action.

Agent Integration — 13 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README. No documentation of how Coder governs auth, routing, or policy enforcement for Auggie.
Dashboard entry point	5	5	The "Standalone mode with a launcher app" example includes a fully specified coder_app resource with slug, display_name, icon, open_in = "slim-window", and a launch command.
Session continuity	5	3	The launcher example uses exec auggie --continue (native resume flag), and the v1 WARNING notes that continue_previous_conversation was removed "in favor of CLI flags in your launcher." However, there is no dedicated section explaining session continuity or how to resume across relaunches.
Managed configuration	5	5	README documents mcp/mcp_files (written to ~/.augment/settings.json), rules (written to ~/.augment/rules/coder-module.md), and auggie_model (sets model key in settings). All with examples and links to Auggie docs.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	augment_session_token is declared sensitive = true in main.tf. README examples reference var.augment_session_token (a variable), never an inline literal or placeholder key. The coder_env resource passes the value without embedding it in the install script.
Non-hardcoded auth path	4	4	The README's Authentication section documents the session-token path: auggie token print → variable → coder_env → AUGMENT_SESSION_AUTH. No raw key is pasted into a template. The alternative (auggie login interactively) is also noted.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	Auggie is installed via npm install -g @augmentcode/auggie. No module input variable overrides the npm registry URL or any download source. auggie_version pins the version but does not change the source URL. No variable can be named that replaces the download URL.
Bring-your-own binary	10	5	install_auggie (default true) can be set to false to skip npm install and validate an existing binary on PATH. The script implements this correctly. However, the README has no section or example demonstrating this mode; it is only described in the Terraform variable description.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (npm registry, Augment API). No air-gapped or restricted-network guidance.
Runs without sudo	2	2	The install script uses npm config set prefix "$HOME/.npm-global" and all mkdir/ln/file writes target $HOME paths. No sudo invocation anywhere in the script.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	All 12 variables have clear descriptions and sensible defaults. augment_session_token is correctly marked sensitive. However, no validation blocks are present (e.g., workdir could validate absolute-path format; auggie_version could validate semver).
Test coverage	4	4	main.tftest.hcl covers Terraform-level business logic (defaults, workdir trimming, env-var creation, base64 encoding, scripts output ordering). main.test.ts provides 12 end-to-end container tests covering install paths, MCP merge semantics, rules writing, model preservation, JSONC handling, secret non-leakage, and pre/post scripts.

Overall — 63 / 100

Raw 58 / 92 → round(58 / 92 × 100) = 63

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.

[coder]

Automated review requested by @matifali. Please sanity-check before acting on it.

• URL: refactor(registry/coder-labs/modules/auggie)!: remove agentapi, tasks and start logic #1177
• Head SHA reviewed: 7123f4a6f0ec98d6713cdc062d36aa9fc1042a75 (draft)
• Verdict: request changes, mainly for S1 (module-managed MCP config goes stale) and because the PR says it wasn't verified in a dogfood workspace. Everything else is minor.

Summary

The agentapi module is replaced with coder-utils@0.0.1. The start script, task_app_id, the coder MCP server (coder_mcp.json with CODER_MCP_APP_STATUS_SLUG/CODER_MCP_AI_AGENTAPI_URL), and the Tasks/launch inputs are removed. folder is renamed to workdir and made optional. MCP servers now go through auggie mcp add-json into ~/.augment/settings.json, rules into ~/.augment/rules/coder-module.md, and the model into the settings.json model key. augment_session_token is now sensitive and AUGMENT_SESSION_AUTH is only set when non-empty; v0 also rendered it into the start script. Version goes 0.3.1 → 1.0.0 in all README examples, and the migration note is thorough.

Correctness

• main.tf (121 lines) is self-consistent: all 7 template args are used, and there are no dangling references.
• Install is npm into ~/.npm-global, same as v0 (v0 also reinstalled on every start). It validates the binary, symlinks into CODER_SCRIPT_BIN_DIR, and adds PATH entries to shell profiles.
• Note in the PR body: not verified in a dogfood workspace (provisioner out of disk). coder exp sync ordering, coder_env delivery, and restart behavior on a real agent are untested. That should happen before this leaves draft.

Leftovers

• None in module code. Grep hits are only the README migration note and the agentapi/test-util import.

Findings

should-fix S1 (blocking for me): changes to module-managed MCP servers never apply after the first start. scripts/install.sh.tftpl:140-155, test at main.test.ts:280
add_mcp_servers keeps any existing name. Since ~/.augment/settings.json persists in the home volume, a server the module itself added on start 1 counts as "existing" on start 2. If a template admin changes the filesystem server's args or URL in mcp/mcp_files, workspaces keep the old definition forever and only log a warning. Removing a server from mcp doesn't remove it either.
This regresses v0, where user_mcp.json was rewritten every start and passed with --mcp-config, so it always reflected the current template. (claude-code's add_mcp_servers uses claude mcp add-json without replace and, as far as I know, behaves the same; I didn't verify that here, but it may be worth a series-level decision.)
Fix: record the module-owned server names under $HOME/.coder-modules/coder-labs/auggie/ and run auggie mcp add-json --replace for those names, while user-added names still win. At minimum, document that updates require manual auggie mcp remove. Add a test that runs install twice with a changed mcp.

should-fix S2: rules can't be cleared. scripts/install.sh.tftpl:184-187
When rules is unset, write_rules returns without touching ~/.augment/rules/coder-module.md, so removed rules keep applying to every session. The module owns this filename, so rm -f "$RULES_FILE" when ARG_RULES is empty is safe.

nit N1: v0 leftovers on persistent homes. ~/.augment/coder_mcp.json holds a CODER_AGENT_TOKEN plus the CODER_MCP_APP_STATUS_SLUG and CODER_MCP_AI_AGENTAPI_URL=http://localhost:3284 entries. ~/.augment/user_mcp.json, ~/.augment/rules.md, and ~/.auggie-module/ also remain. They're inert because v1 doesn't pass --mcp-config, but deleting coder_mcp.json (it holds a credential) during install, or mentioning it in the migration note, would be tidy.

nit N2: jq is now required but not documented. scripts/install.sh.tftpl:35-40,163,201: mcp, mcp_files, and auggie_model now hard-fail without jq. The README (line 11) only lists Node/npm. Add jq to the prerequisite sentence.

nit N3: variable attribute order. main.tf:74-75: augment_session_token puts sensitive before default. AGENTS.md specifies description → type → default → validation → sensitive.

nit N4: constraints are inconsistent with the series. main.tf:2 keeps required_version = ">= 1.0"; kiro-cli and claude-code use >= 1.9. main.tf:7 says coder >= 2.12, but coder-utils needs >= 2.13.

nit N5: tests still import from the agentapi module. main.test.ts:18-21 imports from ../../../coder/modules/agentapi/test-util. This is the same series-wide issue as kiro N4.

nit N6: MCP names with newlines break pairing. scripts/install.sh.tftpl:146,154: the read name && read server pairing breaks if a server name contains a newline. This is an edge case; jq -c '... | [.key, .value]' with a single read would be more robust.

nit N7: the PR body says the npm install happens "now on every start", but v0 also reinstalled every start. Not a regression; just a wording fix.

Tests

• auggie.tftest.hcl is replaced by main.tftest.hcl with 6 runs: defaults, workdir trim and encoding, session token env var not in the script, encoded inputs, and scripts ordering.
• main.test.ts was rewritten with 12 container tests covering bring-your-own binary, pinned/latest npm, npm failure, workdir, MCP keep-existing merge plus a missing file, rules, model preserving settings, JSONC left unchanged, token not leaking, and pre/post scripts. The mock (testdata/auggie-mock.sh) faithfully emulates add-json exit 3.
• Gaps: a second run with changed mcp (S1); clearing rules (S2); missing jq; dropping the interaction_mode validation tests is correct.

CI and reviews

• Passing: Validate Terraform output (TS and terraform tests, validate, shellcheck), lint, typos/format, Validate README files. Compare module scores against main was still in progress; the scorecard bot gave 72/100.
• No human reviews or review comments; nothing unresolved.

Series consistency

It follows the same layout as kiro-cli and claude-code (coder-utils, .coder-modules/coder-labs/auggie, optional workdir, scripts output, launcher coder_app example, migration WARNING). The MCP keep-existing semantics likely match claude-code (unverified; see S1). The required_version mismatch is noted in N4.

[35C4n0r]

Re S1 (module-managed MCP servers never update after the first start): not changing this here.

"Existing name wins" is intentional and matches the rest of the series and claude-code on main:

• claude-code: claude mcp add-json --scope user with no replace, warns and continues on failure.
• cursor-cli (refactor(registry/coder-labs/modules/cursor-cli)!: remove agentapi, tasks and start logic #1152), copilot (feat(registry/coder-labs/modules/copilot): migrate off AgentAPI and Tasks #1117), opencode (refactor(registry/coder-labs/modules/opencode)!: remove agentapi, tasks and start logic #1159), sourcegraph-amp (refactor(registry/coder-labs/modules/sourcegraph-amp)!: remove agentapi, tasks and start logic #1160): merge with servers already on disk winning.

Auggie does the same via a non-interactive auggie mcp add-json, so servers users add or edit in ~/.augment/settings.json are never overwritten. The trade-off (template edits to an already-added name don't reach existing workspaces) applies to every module. If we want module-owned servers to be refreshed, it should be one series-wide change (including claude-code), not an auggie-only divergence.

Generated with Coder Agents.