VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	25 / 25	16 / 20	7 / 20	10 / 10	82 / 100

Drilldown

Track: IDE (VS Code Web is a browser-accessed editor)

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents five distinct configuration modes with working examples: custom install folder, extension install, machine settings merge, version pinning via commit_id, and opening a .code-workspace file — all with sensible defaults shown inline.
Visual preview	5	5	README embeds ../../.images/vscode-web.gif, confirmed to exist (5.2MB GIF).

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module accepts no API keys, tokens, or credentials of any kind; no sensitive input exists and no README example contains inline secrets.
Non-hardcoded auth path	4	0	Module requires no authentication/credentials to operate and README documents no auth path of any kind (not applicable to this module's function, but criterion is not marked "if applicable" in rubric, so scored as absent).

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	Download URLs (https://update.code.visualstudio.com/... and https://vscode.download.prss.microsoft.com/...) are hardcoded in run.sh. commit_id only pins a version/commit hash, not the base URL — no variable overrides the artifact source.
Bring-your-own binary	10	5	offline variable (main.tf) skips download entirely and runs a pre-baked binary from install_prefix; use_cached variable reuses an existing copy. Both are implemented and exercised in tests, but neither is mentioned or exemplified anywhere in the README — fully undocumented, so capped at half.
Egress transparency	3	0	No dedicated network/air-gapped README section; download endpoints are only visible in run.sh source, not documented.
Runs without sudo	2	2	run.sh never invokes sudo; installs to /tmp by default and runs as the invoking user throughout.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions and sensible defaults; validation blocks guard share, telemetry_level, open_in, platform, and accept_license.
Test coverage	4	4	Extensive main.test.ts covers settings merge (jq/python3/fallback paths), extension installation (explicit list, JSONC recommendations, .code-workspace), cached/offline behavior, and license/precondition failures; .tftest.hcl covers open_in logic.

IDE Integration — 25 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource configured with healthcheck, subdomain, share, order, group, and open_in — documented via the primary usage example.
Managed configuration	6	6	settings variable merges into VS Code Machine settings.json, with a dedicated "Pre-configure Machine Settings" README example and documented jq/python3 fallback behavior.
Configurable folder or workdir	6	6	folder and workspace variables each have dedicated README examples ("Install VS Code Web to a custom folder", "Open an existing workspace on startup").
Pre-installed extensions	6	6	extensions variable has a dedicated "Install Extensions" README example with a list of extension IDs.

Overall — 82 / 100

Raw 75 / 92 → round(75 / 92 × 100) = 82

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.