AI Bridge Proxy module

[bpmct]

A discussion dedicated to the AI Bridge Proxy module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	20 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for basic usage, custom certificate path, and proxy with custom port. Each example is clear and demonstrates a distinct configuration mode.
Coder-context framing	8	5	Explains that the module configures workspaces to use AI Bridge Proxy and mentions Coder deployment, but does not clearly show where Coder fits in the overall flow. The "How it works" section describes the proxy but lacks a clear diagram or explanation of the Coder → workspace → proxy → AI provider flow.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The proxy_auth_url output is marked sensitive = true. The session token is embedded in the output but not exposed in README examples. No inline secrets in examples.
Non-hardcoded auth path	4	4	Uses Coder's native session token via data.coder_workspace_owner.me.session_token, avoiding any need for users to paste keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing of its own; it only fetches a certificate from the Coder deployment API. No external artifacts to mirror.
Bring-your-own binary	5	N/A	Module downloads nothing of its own; no binary installation to skip.
Egress transparency	3	N/A	Module contacts only the Coder deployment API (user-controlled), not external endpoints.
Runs without sudo	2	N/A	Module has a script (setup.sh) but it never invokes sudo and runs entirely as the user. However, since all other Restricted-Environment criteria are N/A, this entire theme is N/A per the rubric's normalization rules.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs (agent_id, proxy_url, cert_path) have clear descriptions, sensible defaults where appropriate, and validation rules (URL scheme check, absolute path check).
Test coverage	4	4	Comprehensive .tftest.hcl covers validation, URL formats, and script behavior. TypeScript tests in main.test.ts cover end-to-end scenarios including success, failure modes, custom paths, and server responses.

Overall — 85 / 100

Raw 47 / 55 → round(47 / 55 × 100) = 85

Note: This is a Utility module (helper for routing traffic through AI Bridge Proxy, not an agent or IDE itself). Restricted-Environment Readiness theme is N/A because the module downloads nothing of its own—it only fetches a certificate from the Coder deployment API. Denominator: 25 + 20 + 10 = 55. Actual score: 17 + 20 + 10 = 47. Normalized: round(47 / 55 × 100) = 85.

Correction to Overall calculation:

---

Corrected scorecard:

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	20 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for basic usage, custom certificate path, and proxy with custom port. Each example is clear and demonstrates a distinct configuration mode.
Coder-context framing	8	5	Explains that the module configures workspaces to use AI Bridge Proxy and mentions Coder deployment, but does not clearly show where Coder fits in the overall flow. The "How it works" section describes the proxy but lacks a clear diagram or explanation of the Coder → workspace → proxy → AI provider flow.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The proxy_auth_url output is marked sensitive = true. The session token is embedded in the output but not exposed in README examples. No inline secrets in examples.
Non-hardcoded auth path	4	4	Uses Coder's native session token via data.coder_workspace_owner.me.session_token, avoiding any need for users to paste keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing of its own; it only fetches a certificate from the Coder deployment API. No external artifacts to mirror.
Bring-your-own binary	5	N/A	Module downloads nothing of its own; no binary installation to skip.
Egress transparency	3	N/A	Module contacts only the Coder deployment API (user-controlled), not external endpoints.
Runs without sudo	2	N/A	The setup.sh script never invokes sudo and runs entirely as the user. However, since all download-related criteria are N/A, the entire Restricted-Environment theme is excluded per normalization rules.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs (agent_id, proxy_url, cert_path) have clear descriptions, sensible defaults where appropriate, and validation rules (URL scheme check, absolute path check).
Test coverage	4	4	Comprehensive .tftest.hcl covers validation, URL formats, and script behavior. TypeScript tests in main.test.ts cover end-to-end scenarios including success, failure modes, custom paths, and server responses.

Overall — 85 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.