[matifali]

Description

Adds additional_args to mux and deprecates additional_arguments. The goal is one name for this input across the registry; the AGENTS.md rule is in coder/registry#1202.

additional_args is a list(string) with one element per argument. Each element is passed to mux server exactly as written and in order, so a flag can repeat and a value can contain spaces without quoting.

module "mux" {
  count           = data.coder_workspace.me.start_count
  source          = "registry.coder.com/coder/mux/coder"
  version         = "2.1.0"
  agent_id        = coder_agent.main.id
  additional_args = ["--open-mode", "pinned"]
}

• Nothing breaks: additional_arguments (the shell-style string) still works exactly as before and is appended after additional_args. Its description and the README mark it deprecated.
• Verbatim values: additional_args is base64-encoded one argument per line and decoded in run.sh without xargs or quote parsing, so values reach mux as written.
• Validation: elements must be non-empty and must not contain newlines.
• Flags the module sets are rejected: --port and --add-project, with or without =value; use the port and add_project inputs instead. A comment in main.tf and in run.sh says to keep this list in sync.

An earlier version of this PR used a map(string) of flag to value. Per review on coder/registry#1202, a map can't repeat a flag, and Terraform silently keeps only the last value of a repeated key. So the input is now a list.

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

Path: registry/coder/modules/mux
New version: v2.1.0
Breaking change: [ ] Yes [x] No — additional_args defaults to [] and additional_arguments is unchanged.

Testing & Validation

• Tests pass: terraform test, 27 passed. Covered: encoding a repeated -v in order; rejecting a newline; rejecting --port=8080; additional_arguments still applied.
• The container test covers additional_args followed by additional_arguments. It can't run here because the runner has no Docker daemon.
• Code formatted (bun fmt); ./scripts/terraform_validate.sh passes
• Changes tested locally: applied the module, extracted the rendered coder_script, and ran it against a stub mux. The argv was server --port 4000 --open-mode <pinned tab $HOME> -v -v --add-project </workspaces/my repo>: values unchanged, the repeated -v kept, and the deprecated string appended last.

Related Issues

None

---

Generated by Claude Code

[github-actions]

Module Scorecard Check

coder/mux: 77 → 72

⚠️ Score regression: 77 → 72 (-5). Check the drilldown for which criteria dropped.

Theme	Before	After
Presentation & Onboarding	17 / 17	17 / 17
Integration	5 / 25	12.5 / 25
Credential Hygiene	20 / 20	16 / 20
Restricted-Environment	18.5 / 20	11 / 20
Engineering Quality	10 / 10	10 / 10
Overall	77 / 100	72 / 100

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	12.5 / 25	16 / 20	11 / 20	10 / 10	72 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README has 10+ dedicated examples (Basic, Pin Version, Open Project, Additional Args, Restart on Kill, Custom Port, Package Manager, Custom Registry, Use Cached, Skip Install), each with sensible defaults called out.
Visual preview	5	5	 is embedded and verified to exist (249.1 KB).

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No user-supplied secret inputs exist; the random_password.mux_auth_token is generated internally, never surfaced as a plaintext variable, and no README example inlines a key/token.
Non-hardcoded auth path	4	0	No mention of ServiceAccount, IAM/OAuth, API-key helper, or AI Gateway for authenticating the agent itself.

Restricted-Environment Readiness — 11 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	2.5	registry_url variable overrides the npm registry used for both npm/pnpm/bun install and the tarball-fallback URL for @coder/xum — a real download-URL override. However the Node.js runtime bootstrap is hardcoded to https://nodejs.org/dist/... with no override variable, so only part of the install path is mirrorable.
Bring-your-own binary	10	5	install = false is documented in a dedicated "Skip Install" example requiring a pre-placed mux binary. However ensure_node() runs unconditionally before the offline check, so if Node isn't already present the script still reaches out to nodejs.org even with install=false — undocumented gap that undermines "disable install entirely."
Egress transparency	3	1.5	No dedicated network/offline section; endpoints (registry.npmjs.org, nodejs.org) are only inferable from scattered Notes/variable descriptions, not enumerated together.
Runs without sudo	2	2	run.sh never invokes sudo; all installs/writes target $HOME-relative paths.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults, and validations (package_manager, open_in, share, restart_delay_seconds, max_restart_attempts, additional_args).
Test coverage	4	4	Extensive mux.tftest.hcl covering business logic (args parsing, restart behavior, path defaults, registry handling) plus main.test.ts with real container-based end-to-end behavior (install, restart, signal logging).

Agent Integration — 12.5 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README.
Dashboard entry point	5	5	coder_app is built into the module with healthcheck, subdomain/share/order/group/open_in options, auto-wired with an auth token in the URL.
Session continuity	5	2.5	Features list states "Long-Running Processes: Resume AI work after interruptions," but no detail on mechanism (session IDs, persistent manager) is documented — under-documented.
Managed configuration	5	5	add_project variable gives documented, dedicated workdir configuration ("Open a Project on Launch" example).

Overall — 72 / 100

Raw 66.5 / 92 → round(66.5 / 92 × 100) = 72

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.