VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	23 / 25	20 / 20	10 / 20	8 / 10	86 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom folder, extensions, settings, version pinning, workspace files, and offline/cached modes. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and VS Code Web, explains it installs VS Code Server in a workspace and creates a dashboard app to access it.
Visual preview	5	5	README includes a GIF showing VS Code Web with GitHub Copilot and live-share in action.

IDE Integration — 23 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper healthcheck, subdomain support, and configurable open_in behavior (slim-window/tab).
Managed configuration	6	6	Documented support for managed settings via settings variable with merge behavior. README shows example configuring theme and fontSize.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. Module constructs proper URL query parameters for each.
Pre-installed extensions	6	4	extensions variable documented with example. auto_install_extensions documented for .vscode/extensions.json and .code-workspace files. However, no example showing both explicit extensions list AND auto-install together, and the auto-install feature requires jq which may not be present.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. VS Code Server uses license acceptance only, no API keys or secrets. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Module uses VS Code Server's built-in license acceptance mechanism (--accept-server-license-terms), no API keys or external auth required.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the download URL. The script hardcodes https://update.code.visualstudio.com/api/commits/... and https://vscode.download.prss.microsoft.com/.... commit_id pins a version but does not change the source URL.
Bring-your-own binary	5	5	offline and use_cached variables documented. When offline=true, script expects pre-installed binary at install_prefix and skips download entirely.
Egress transparency	3	3	No dedicated section, but endpoints are documented across examples: VS Code update API and download URLs are shown in the version pinning example with actual domains. Extension marketplace is implicit from extension install feature.
Runs without sudo	2	2	Inspected run.sh: no sudo invocations. All operations (mkdir, curl, tar, file writes) work as unprivileged user in user-writable paths.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 13338, telemetry_level "error", share "owner"). Validation blocks on accept_license, share, telemetry_level, open_in, platform, and mutual exclusivity of offline/use_cached and workspace/folder.
Test coverage	4	2	Comprehensive TypeScript tests cover settings merge (jq, python3, fallback), JSONC stripping, auto-install extensions, and various edge cases. However, .tftest.hcl only tests open_in validation—does not cover business logic like offline/use_cached preconditions, workspace/folder mutual exclusivity, or extension installation paths.

Overall — 86 / 100

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.