VS Code Web module

[bpmct]

A discussion dedicated to the VS Code Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	22 / 25	20 / 20	7 / 20	8 / 10	82 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom folder, extensions, settings, version pinning, workspace files, and offline/cached modes. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and VS Code Server, explains it installs VS Code Server in a workspace and creates a dashboard app to access it.
Visual preview	5	5	README includes a GIF showing VS Code Web with GitHub Copilot and live-share in action.

IDE Integration — 22 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper healthcheck, subdomain support, and configurable open_in behavior (tab or slim-window).
Managed configuration	6	6	Documented support for managed settings via settings variable with merge behavior. README shows example configuring workbench.colorTheme.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. Validation ensures only one is set.
Pre-installed extensions	6	3	Extensions can be pre-installed via extensions variable with documented example. However, auto_install_extensions feature for workspace recommendations is documented but requires jq at runtime (not pre-installed), making it awkward for true pre-installation.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Module uses --without-connection-token and relies on Coder's built-in authentication via the agent and app proxy. No raw keys required.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable overrides the VS Code Server download URL. The script hardcodes https://vscode.download.prss.microsoft.com/dbazure/download/stable/$HASH/vscode-server-.... commit_id pins a version but does not change the source URL.
Bring-your-own binary	5	5	offline variable documented to skip download when VS Code Web is already present. README example shows pinning versions, and offline mode is explicitly documented.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are inferable from code (update.code.visualstudio.com, vscode.download.prss.microsoft.com) but not documented.
Runs without sudo	2	2	Scripts in run.sh never invoke sudo. All operations (mkdir, curl, tar, file writes) work as unprivileged user.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Inputs have clear descriptions, sensible defaults, and validation rules (e.g., accept_license, share, telemetry_level, open_in, preconditions for offline/extensions conflicts).
Test coverage	4	2	TypeScript tests cover settings merge behavior (jq, python3, fallback scenarios) and validation logic. .tftest.hcl covers open_in validation. However, no end-to-end test verifying actual VS Code Web installation and startup. Tests mock the binary rather than testing real download/install.

Overall — 82 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.