Claude Code module

[bpmct]

A discussion dedicated to the Claude Code module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
19 / 25	10 / 25	10 / 20	7 / 20	8 / 10	54 / 100

Drilldown

Presentation & Onboarding — 19 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple major modes documented: standalone with API key, standalone with OAuth token, AI Gateway, AWS Bedrock, Google Vertex AI, managed settings, telemetry. Each has sensible defaults and clear examples.
Coder-context framing	8	7	README explains Claude Code is installed in workspaces and shows Coder fits in the flow (AI Gateway, workspace owner session token, coder_app launcher). Names both Coder and Claude Code. Does not explicitly state what Claude Code adds on top of base Coder beyond "install and configure the Claude Code CLI".
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Agent Integration — 10 / 25

Criterion	Max	Score	Notes
AI governance	10	5	AI Gateway documented with enable_ai_gateway variable and example showing ANTHROPIC_BASE_URL routing through Coder's aibridge endpoint. Agent Firewall support explicitly dropped in v5 per WARNING block: "v5 is a major refactor that drops support for...Boundary". Half credit for AI Gateway only.
Dashboard entry point	5	5	Documented coder_app example in "Standalone mode with a launcher app" section showing command that runs claude in workdir with open_in = "slim-window".
Session continuity	5	0	No documentation of resuming existing sessions, session IDs, or persistent session managers (tmux, screen, boo).
Managed configuration	5	0	managed_settings variable writes policy to /etc/claude-code/managed-settings.d/10-coder.json but this is settings/permissions policy, not MCP server management. MCP servers are added at user scope via mcp and mcp_config_remote_path but README does not document managed MCP configuration (admin-controlled MCP servers that users cannot override).

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	anthropic_api_key and claude_code_oauth_token variables marked sensitive = true in main.tf. However, README examples inline placeholder secrets: anthropic_api_key = "xxxx-xxxxx-xxxx", claude_code_oauth_token = "xxxxx-xxxx-xxxx", aws_access_key_id/aws_secret_access_key with placeholder values. Per rubric, inline secrets in examples cap this at half.
Non-hardcoded auth path	4	2	AI Gateway mode (enable_ai_gateway = true) uses workspace owner session token, avoiding raw API keys. However, this is one of three auth methods; the other two (anthropic_api_key, claude_code_oauth_token) require pasting keys. Partial credit for offering one non-hardcoded path.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module variable overrides the Claude Code installer download URL. install_claude_code = false skips installation entirely (belongs to bring-your-own binary). claude_code_version pins a version but does not change the source URL. The installer script uses hardcoded curl -fsSL claude.ai/install.sh with no override mechanism.
Bring-your-own binary	5	5	install_claude_code = false documented in "Advanced Configuration" example with note that claude_binary_path can be customized when install is disabled. Validation enforces this constraint.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints appear scattered across examples (claude.ai/install.sh, console.anthropic.com, raw.githubusercontent.com, packages.cloud.google.com) but are not consolidated in a network/air-gapped/restricted section. Per rubric, scattered mentions earn at most half, but without a dedicated section, score 0.
Runs without sudo	2	2	install.sh.tftpl script inspected: sudo used only in write_managed_settings function for /etc/claude-code/managed-settings.d/ with fallback to non-sudo mkdir/echo/chmod when sudo is unavailable (command_exists sudo check). Core install via curl installer and MCP configuration do not require sudo. Per rubric, sudo for optional feature with working fallback earns full credit from code alone.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Most inputs have descriptions. Defaults present for icon, install_claude_code, claude_code_version, disable_autoupdater, model, claude_binary_path, telemetry. Validation on enable_ai_gateway mutual exclusion and claude_binary_path constraint. However, some inputs lack validation where appropriate: anthropic_api_key and claude_code_oauth_token have no mutual exclusion validation (both can be set simultaneously, unclear precedence), mcp has no JSON validation, managed_settings type = any with no schema validation.
Test coverage	4	4	main.test.ts covers end-to-end scenarios: install version pinning, API key/OAuth token auth, MCP config (inline and remote), pre/post scripts, workdir, managed settings, telemetry, AI Gateway, standalone modes. main.tftest.hcl covers plan-time validation and variable handling. Business logic (script orchestration, env var injection) tested in TypeScript; Terraform logic tested in .tftest.hcl. Clear testing story.

Overall — 54 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.