VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	23 / 25	20 / 20	10 / 20	8 / 10	85 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides comprehensive examples covering major modes: custom folder installation, extension installation, machine settings configuration, version pinning, workspace opening. Each example is complete and uses sensible defaults.
Visual preview	5	5	README embeds ../../.images/vscode-web.gif showing VS Code Web with GitHub Copilot and live-share in action. Image verified to exist (5277.4 KB).

IDE Integration — 23 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource configured with proper healthcheck, subdomain support, and configurable open_in behavior (slim-window/tab). Tests verify default and custom open_in values.
Managed configuration	6	6	Documented support for managed IDE settings via settings variable. README example shows configuring Machine settings.json with theme. Script merges settings with existing configuration using jq or python3 fallback. Tests verify merge behavior.
Configurable folder or workdir	6	6	folder variable documented with example showing opening a specific directory. workspace variable supports opening .code-workspace files. Validation ensures only one is set. URL construction properly encodes folder/workspace parameters.
Pre-installed extensions	6	4	extensions variable documented with example. auto_install_extensions feature documented and tested for both extensions.json and .code-workspace files. However, auto-install requires jq at runtime (not pre-installed), and the JSONC stripping approach is complex. Loses points for requiring external dependency and implementation complexity.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. All configuration is non-secret (ports, paths, extensions, settings). README examples contain no API keys or credentials.
Non-hardcoded auth path	4	4	VS Code Server uses --without-connection-token and --accept-server-license-terms flags. No API keys or secrets required. Authentication handled by Coder's app proxy.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable to override the download URL. The script hardcodes https://update.code.visualstudio.com/api/commits/... and https://vscode.download.prss.microsoft.com/.... commit_id pins a version but does not change the source URL. install_prefix only changes the destination directory.
Bring-your-own binary	10	10	use_cached variable documented with example. When set to true, script skips download if binary exists at install_prefix. offline variable also documented for running without any fetch. Tests verify both modes work correctly and still install extensions.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The update.code.visualstudio.com and vscode.download.prss.microsoft.com URLs are only visible in source code. Extension marketplace endpoints (implicit in --install-extension) not documented.
Runs without sudo	2	0	Script inspection shows no sudo invocations. However, the script uses tar -xz which may fail without write permissions to INSTALL_PREFIX, and creates directories/files that require appropriate permissions. The default /tmp/vscode-web works unprivileged, but custom paths may not. No README documentation of permission requirements or non-root operation. Scores 0 because while the script doesn't call sudo, it's not documented and permission requirements are unclear.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 13338, /tmp paths, telemetry level "error"). Validation on accept_license (must be true), share (owner/authenticated/public), telemetry_level (off/crash/error/all), open_in (tab/slim-window), platform (linux/darwin/alpine/win32). Preconditions prevent invalid combinations (offline+extensions, offline+use_cached, workspace+folder).
Test coverage	4	2	TypeScript tests in main.test.ts cover settings merge (jq, python3, neither), JSONC stripping for extensions.json and .code-workspace, use_cached mode, auto_install_extensions, and validation failures. However, .tftest.hcl only tests open_in validation—no business logic coverage. Tests are comprehensive for runtime behavior but Terraform-level testing is minimal.

Overall — 85 / 100

Raw 78 / 92 → round(78 / 92 × 100) = 85

---

Scored against SCORECARD.md on 2026-08-26 with claude-sonnet-4-5.