code-server module

[bpmct]

A discussion dedicated to the code-server module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	25 / 25	20 / 20	12 / 20	10 / 10	91 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents every major mode with dedicated examples: default install, pin versions, pre-install extensions, workspace recommendations (with git-clone coordination), user settings, multiple extensions, workspace file, additional args, offline, and use-cached. Each example uses sensible defaults and is self-contained.
Visual preview	5	5	README embeds  — an actual image of code-server in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The module contains no sensitive inputs (no API keys, tokens, or passwords). code-server runs with --auth none; access control is delegated to Coder workspace sharing. No inline secrets appear in any README example.
Non-hardcoded auth path	4	4	The module inherently avoids hardcoded auth: run.sh launches code-server with --auth none, and no credential variables exist. The "If possible" qualifier is satisfied by construction — there are no keys to paste.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The install URL https://code-server.dev/install.sh is hardcoded in run.sh (line: curl -fsSL https://code-server.dev/install.sh | sh -s --). No module input variable overrides this download URL. install_prefix controls install location, install_version pins the version, and offline/use_cached skip the download — none replace the source URL.
Bring-your-own binary	10	10	Two documented modes disable download entirely: offline = true ("Just run code-server in the background, don't fetch it from GitHub") and use_cached = true ("Run an existing copy of code-server if found, otherwise download from GitHub"). Both are shown in the "Offline and Use Cached Modes" README section with full examples.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (code-server.dev, OpenVSX, GitHub). The "Offline and Use Cached Modes" section mentions "don't fetch it from GitHub" but does not list all contacted domains or provide air-gapped guidance. Mentions are scattered across examples, not consolidated.
Runs without sudo	2	2	run.sh contains zero sudo invocations. All paths are user-writable: install prefix defaults to /tmp/code-server, settings go to ~/.local/share/code-server/, extensions use user-level directories.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 24 variables have description fields. Sensible defaults throughout (port 13337, empty lists/maps, false for toggles). validation blocks on workspace (must end .code-workspace, mutually exclusive with folder), share (owner/authenticated/public), and open_in (tab/slim-window). agent_id correctly has no default (required).
Test coverage	4	4	.tftest.hcl (8 runs) covers business logic: URL construction with folder/workspace query params, mutual-exclusion conflicts, offline+extensions rejection, required vars. main.test.ts (9 tests) covers end-to-end: settings creation/merging (user + machine), JSONC extension parsing, pre-auto-install script coordination, missing-recommendations edge case, and full install+healthcheck in a real container.

IDE Integration — 25 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with healthcheck (/healthz, interval 5, threshold 6), configurable open_in (tab/slim-window), subdomain toggle, share/order/group for dashboard placement. README examples show the app accessible via dashboard.
Managed configuration	6	6	settings variable (User settings.json, merged on startup) documented with a "Pre-configure User Settings" example. machine_settings variable (Machine settings.json) present in code with description. Both use base64-encoded JSON merged via jq/python3 with graceful fallback.
Configurable folder or workdir	6	6	folder variable opens a directory; workspace variable opens a .code-workspace file. Both documented in README with examples ("Open a Workspace File", git-clone coordination example). Mutually exclusive, validated.
Pre-installed extensions	6	6	extensions list installs from OpenVSX on start; auto_install_extensions reads .vscode/extensions.json or .code-workspace recommendations; use_cached_extensions skips re-install. README shows "Pre-install Extensions", "Install multiple extensions", and "Install Workspace Recommendations" examples.

Overall — 91 / 100

Raw 84 / 92 → round(84 / 92 × 100) = 91

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.