Xum module

[github-actions[bot]]

A discussion dedicated to the Xum module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	12.5 / 25	16 / 16	18.5 / 20	10 / 10	84 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README has ten distinct, well-documented examples covering every major mode: basic usage, version pinning, add_project, additional_arguments, restart-on-kill, custom port, package manager override, custom registry, cached install, and skip-install — each with sensible defaults shown.
Visual preview	5	5	README embeds , confirmed to exist (249.1 KB).

Credential Hygiene — 16 / 16 (Non-hardcoded auth path marked N/A, −4 from denominator)

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The module generates its own per-instance auth token via random_password (not a user-supplied secret); no README example contains an inline/hardcoded key, and there is no user-facing credential input that should be marked sensitive.
Non-hardcoded auth path	4	N/A	The module requires no external service credentials (xum needs no IAM/API key to operate); the concern does not exist by construction, so excluded from scoring.

Restricted-Environment Readiness — 18.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	registry_url variable (default https://registry.npmjs.org) directly overrides the npm registry URL used by npm/pnpm/bun install and the tarball-fallback metadata/tarball fetch in run.sh, documented under "Custom Registry."
Bring-your-own binary	10	10	install = false documented under "Skip Install," runs without any network install when a pre-existing xum binary is present at <install_prefix>/xum.
Egress transparency	3	1.5	No dedicated network/air-gapped section; endpoints (npm registry, nodejs.org Node bootstrap) are only scattered across the "Notes" list without being enumerated as endpoints, and the Node.js download URL isn't mentioned in the README at all.
Runs without sudo	2	2	run.sh never invokes sudo; all install/runtime steps (npm install, tarball extraction, Node bootstrap) run as the workspace user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions and defaults; validations present for package_manager, open_in, share, restart_delay_seconds, max_restart_attempts.
Test coverage	4	4	xum.tftest.hcl has extensive business-logic coverage (restart logic, package manager selection, registry URL handling, path defaults); main.test.ts covers end-to-end install/run behavior across package managers, signal handling, and restart flows in real containers.

Agent Integration — 12.5 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README.
Dashboard entry point	5	5	coder_app resource is defined with slug, display name, icon, healthcheck, and documented configuration options (share, order, group, open_in).
Session continuity	5	2.5	restart_on_kill documents automatically restarting the xum server process after exit/crash, but this is server-process resiliency, not explicitly documented agent-session resume/reconnect support.
Managed configuration	5	5	add_project is documented ("Open a Project on Launch") to set the workdir/project xum opens at startup, satisfying managed workdir config.

Overall — 84 / 100

Raw 74 / 88 → round(74 / 88 × 100) = 84

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.