VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	22 / 25	20 / 20	7 / 20	8 / 10	82 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom folder installation, extension installation, machine settings configuration, version pinning, workspace opening. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and VS Code Server, explains it installs VS Code Server in a workspace and creates a dashboard app to access it. Shows Coder's role in the flow.
Visual preview	5	5	README includes a GIF showing VS Code Web with GitHub Copilot and live-share in action.

IDE Integration — 22 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper healthcheck, configurable subdomain, share, order, group, and open_in behavior.
Managed configuration	6	6	Documented support for managed Machine settings via settings variable with merge behavior. Example shows theme configuration.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. Mutual exclusion enforced via precondition.
Pre-installed extensions	6	3	extensions variable documented with example. auto_install_extensions variable exists but only documented in code comments, not README examples. Half credit for partial documentation.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. No README examples inline secrets.
Non-hardcoded auth path	4	4	VS Code Server uses --without-connection-token and --accept-server-license-terms flags; no API keys or secrets required. Authentication handled by Coder's app proxy.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable overrides the download URL. The script hardcodes https://update.code.visualstudio.com and https://vscode.download.prss.microsoft.com. commit_id pins a version but does not change the source URL. install_prefix changes install location, not download source.
Bring-your-own binary	5	5	offline variable documented: "Just run VS Code Web in the background, don't fetch it from the internet." Requires pre-installed binary at install_prefix.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are inferable from code (update.code.visualstudio.com, vscode.download.prss.microsoft.com) but not documented.
Runs without sudo	2	2	Inspected run.sh: no sudo invocations. All operations (mkdir, curl, tar, file writes) work as unprivileged user.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults. Validation on accept_license (must be true), share (enum), telemetry_level (enum), open_in (enum), platform (enum). Preconditions enforce mutual exclusions (offline/use_cached, offline/extensions, workspace/folder).
Test coverage	4	2	.tftest.hcl covers open_in validation. TypeScript tests in main.test.ts cover license validation, mutual exclusion preconditions, settings file creation/merging with jq/python3/fallback paths. However, no end-to-end test of actual VS Code Web installation or app accessibility. Half credit for partial coverage.

Overall — 82 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.