File Browser module

[bpmct]

A discussion dedicated to the File Browser module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	20 / 20	0 / 20	8 / 10	71 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for serving a specific directory, specifying database path, and subdomain vs path-based modes. Each example is clear with sensible defaults.
Coder-context framing	8	8	README clearly states "A file browser for your workspace" and shows integration with coder_agent. The context is clear that this adds file browsing capability to Coder workspaces.
Visual preview	5	5	README includes  showing the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The module configures filebrowser with --auth.method=noauth and creates a default admin user internally, but exposes no secret inputs to template authors.
Non-hardcoded auth path	4	4	No authentication credentials are required or exposed. The module uses noauth mode, relying on Coder's workspace access controls.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The install script hardcodes curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh. No module variable overrides this download URL.
Bring-your-own binary	5	0	No documented way to skip the download when filebrowser is pre-installed. The script checks if ! command -v filebrowser and skips download if found, but this is not documented in the README.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The GitHub raw URL is visible only in source code (run.sh), not documented.
Runs without sudo	2	0	The install script curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash executes the filebrowser installer which requires root/sudo for installation to system paths. The script does not handle non-root scenarios.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (port 13339, folder ~, subdomain true). Validation exists for database_path (must end with filebrowser.db) and share (enum validation). Lifecycle precondition validates agent_name requirement when subdomain=false.
Test coverage	4	2	TypeScript tests in main.test.ts cover multiple scenarios (default, database_path, folder, subdomain modes, validation failures). However, no .tftest.hcl file exists for Terraform-native testing. Tests are end-to-end only, missing unit-level business logic coverage.

Overall — 71 / 100

Raw 53 / 75 → round(53 / 75 × 100) = 71

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.