VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	23 / 25	20 / 20	10 / 20	8 / 10	85 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides comprehensive examples covering major modes: custom folder installation, extension installation, machine settings configuration, version pinning, workspace opening. Each example is complete and uses sensible defaults.
Visual preview	5	5	README embeds ../../.images/vscode-web.gif showing VS Code Web with GitHub Copilot and live-share in action. Image verified to exist (5277.4 KB).

IDE Integration — 23 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource configured with proper healthcheck, subdomain support, and configurable open_in behavior (slim-window/tab).
Managed configuration	6	6	Documented support for managed IDE settings via settings variable. README example shows configuring Machine settings.json with theme. Script merges settings with existing configuration using jq or python3 fallback.
Configurable folder or workdir	6	6	folder variable documented with example showing opening a specific directory. workspace variable also supported for .code-workspace files. Validation ensures only one is set.
Pre-installed extensions	6	4	extensions variable documented with example. auto_install_extensions feature documented and tested for reading from .vscode/extensions.json and .code-workspace files. However, auto-install requires jq at runtime (not pre-installed), making it less robust than fully pre-installing extensions during image build.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module has no secret inputs. VS Code Server uses license acceptance model (accept_license boolean) rather than API keys. No sensitive data handling required.
Non-hardcoded auth path	4	4	VS Code Server authentication is handled via --without-connection-token flag and Coder's built-in app authentication. No raw keys or tokens required in templates.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable to override the download URL. The script hardcodes https://update.code.visualstudio.com/api/commits/... and https://vscode.download.prss.microsoft.com/.... commit_id pins a version but does not change the source URL. install_prefix only changes the destination path.
Bring-your-own binary	10	10	use_cached variable documented with example. When set to true, script skips download if binary exists at install_prefix. offline variable also supported for fully offline operation. Both modes still install extensions and apply settings.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The update.code.visualstudio.com and vscode.download.prss.microsoft.com URLs are visible only in source code. Extension marketplace endpoints (implicit in --install-extension) are not documented.
Runs without sudo	2	0	Script in run.sh never invokes sudo and runs entirely as the agent user. Full credit earned from code inspection alone per rubric exception. CORRECTION: Re-reading rubric - this should be 2/2, but keeping 0 as initially scored since the script does work without sudo but this wasn't explicitly verified in all paths. FINAL: 0 is incorrect per rubric. Script verifiably never uses sudo. Score should be 2. Adjusting total.

Correction: Runs without sudo should be 2/2. Script never invokes sudo anywhere. Adjusted theme total: 12 / 20.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 13338, /tmp paths, telemetry level "error"). Validation blocks on accept_license, share values, telemetry_level, open_in, platform, and mutual exclusivity of offline/use_cached and workspace/folder.
Test coverage	4	2	.tftest.hcl covers open_in validation. main.test.ts provides extensive end-to-end coverage: license validation, mutual exclusion checks, settings creation/merging with jq and python3 fallbacks, JSONC parsing for extensions.json and .code-workspace files, use_cached behavior, auto-install extensions. However, tests mock the VS Code binary rather than testing against real installations, limiting confidence in production behavior.

Overall — 85 / 100

Raw 78 / 92 → round(78 / 92 × 100) = 85 → 85 / 100

Correction for Runs without sudo: Raw should be 80 / 92 → round(80 / 92 × 100) = 87

Final corrected scorecard:

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	23 / 25	20 / 20	12 / 20	8 / 10	87 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides comprehensive examples covering major modes: custom folder installation, extension installation, machine settings configuration, version pinning, workspace opening. Each example is complete and uses sensible defaults.
Visual preview	5	5	README embeds ../../.images/vscode-web.gif showing VS Code Web with GitHub Copilot and live-share in action. Image verified to exist (5277.4 KB).

IDE Integration — 23 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource configured with proper healthcheck, subdomain support, and configurable open_in behavior (slim-window/tab).
Managed configuration	6	6	Documented support for managed IDE settings via settings variable. README example shows configuring Machine settings.json with theme. Script merges settings with existing configuration using jq or python3 fallback.
Configurable folder or workdir	6	6	folder variable documented with example showing opening a specific directory. workspace variable also supported for .code-workspace files. Validation ensures only one is set.
Pre-installed extensions	6	4	extensions variable documented with example. auto_install_extensions feature documented and tested for reading from .vscode/extensions.json and .code-workspace files. However, auto-install requires jq at runtime (not pre-installed), making it less robust than fully pre-installing extensions during image build.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module has no secret inputs. VS Code Server uses license acceptance model (accept_license boolean) rather than API keys. No sensitive data handling required.
Non-hardcoded auth path	4	4	VS Code Server authentication is handled via --without-connection-token flag and Coder's built-in app authentication. No raw keys or tokens required in templates.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable to override the download URL. The script hardcodes https://update.code.visualstudio.com/api/commits/... and https://vscode.download.prss.microsoft.com/.... commit_id pins a version but does not change the source URL. install_prefix only changes the destination path.
Bring-your-own binary	10	10	use_cached variable documented with example. When set to true, script skips download if binary exists at install_prefix. offline variable also supported for fully offline operation. Both modes still install extensions and apply settings.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The update.code.visualstudio.com and vscode.download.prss.microsoft.com URLs are visible only in source code. Extension marketplace endpoints (implicit in --install-extension) are not documented.
Runs without sudo	2	2	Script in run.sh never invokes sudo anywhere. All operations (mkdir, curl, tar, extension installation, settings management) run as the agent user. Full credit per rubric exception for verifiable code.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 13338, /tmp paths, telemetry level "error"). Validation blocks on accept_license, share values, telemetry_level, open_in, platform, and mutual exclusivity of offline/use_cached and workspace/folder.
Test coverage	4	2	.tftest.hcl covers open_in validation. main.test.ts provides extensive end-to-end coverage: license validation, mutual exclusion checks, settings creation/merging with jq and python3 fallbacks, JSONC parsing for extensions.json and .code-workspace files, use_cached behavior, auto-install extensions. However, tests mock the VS Code binary rather than testing against real installations, limiting confidence in production behavior.

Overall — 85 / 100 → 87 / 100

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.