devcontainers-cli module

[bpmct]

A discussion dedicated to the devcontainers-cli module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
8 / 25	N/A	0 / 20	7 / 10	27 / 100

Drilldown

Presentation & Onboarding — 8 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	8	Single example provided with start_blocks_login option shown. No examples for different package manager scenarios or pre-installed binary cases, though the module auto-detects package managers. Partial coverage of major modes.
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or where Coder fits in the devcontainers workflow. Simply states it "provides an easy way to install @devcontainers/cli into a workspace" without Coder-specific context.
Visual preview	5	0	No image, GIF, or video. Only an icon reference in frontmatter.

Credential Hygiene — N/A

Criterion	Max	Score	Notes
Secrets marked sensitive	16	N/A	Module has no credential or secret inputs.
Non-hardcoded auth path	4	N/A	No authentication required.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The module installs @devcontainers/cli from npm/yarn/pnpm registries with hardcoded package names. No variable exists to override the registry URL or package source. The install commands use default registries.
Bring-your-own binary	5	0	No documented way to skip installation when devcontainers-cli is pre-installed. The script checks if command -v devcontainer and exits early if found, but this is undocumented behavior, not a configurable option.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The npm/yarn/pnpm registries are implicit from the code but not documented.
Runs without sudo	2	0	Script uses npm install -g, pnpm add -g, and yarn global add which typically require root permissions to write to global directories like /usr/local/bin. The script does not document a non-sudo path or use user-local installation directories by default.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Both inputs (agent_id, start_blocks_login) have clear descriptions and appropriate types. start_blocks_login has a sensible default of false. No validation blocks needed for these simple inputs.
Test coverage	4	1	TypeScript tests in main.test.ts cover multiple package managers and error cases (missing package manager, missing docker warning). However, no .tftest.hcl file exists to test Terraform business logic. Tests are end-to-end only.

Overall — 27 / 100

Raw 15 / 55 → round(15 / 55 × 100) = 27

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.