Claude Code module

[bpmct]

A discussion dedicated to the Claude Code module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17.5 / 25	10 / 25	18 / 20	7 / 20	8 / 10	61 / 100

Drilldown

Presentation & Onboarding — 17.5 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple major modes documented with sensible defaults: standalone with API key, AI Gateway, Bedrock, Vertex AI, custom gateway, OAuth token, api_key_helper. Each has a complete example.
Coder-context framing	8	5.5	README names both Coder and Claude Code, explains authentication flows (AI Gateway, session tokens), and shows Coder-specific integration (coder_app, coder_env). However, it does not clearly explain what Claude Code adds on top of Coder or where Coder fits in the developer flow—the opening paragraph jumps directly to installation without framing the value proposition.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

Agent Integration — 10 / 25

Criterion	Max	Score	Notes
AI governance	10	5	AI Gateway is documented with enable_ai_gateway and a dedicated example showing ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN setup. However, the WARNING at the top explicitly states "v5 drops support for Agent Firewall" and plans to add it back later. Only AI Gateway is currently supported, earning half credit.
Dashboard entry point	5	5	Documented coder_app example in "Standalone mode with a launcher app" section shows slug, display_name, icon, open_in, and command that launches claude in the workdir.
Session continuity	5	0	No documentation of resuming existing sessions, session IDs, or persistent session managers (tmux, screen, boo). The module configures authentication and onboarding bypass but does not address session persistence across reconnects.
Managed configuration	5	0	The managed_settings input writes policy to /etc/claude-code/managed-settings.d/ but this is for permissions/policy enforcement, not MCP server management. MCP servers are added at user scope via .claude.json, not managed/enforced scope. The README does not document managed MCP configuration.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	anthropic_api_key and claude_code_oauth_token are marked sensitive = true in main.tf. However, README examples inline placeholder secrets (anthropic_api_key = "xxxx-xxxxx-xxxx", claude_code_oauth_token = "xxxxx-xxxx-xxxx") in multiple code blocks, capping this at 14/16 per the rubric's inline-secrets disqualifier.
Non-hardcoded auth path	4	4	Multiple non-hardcoded paths documented: AI Gateway (enable_ai_gateway uses workspace owner session token), api_key_helper (Vault/AWS Secrets Manager examples), Bedrock (AWS credential chain), Vertex AI (Application Default Credentials).

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the Claude Code download URL. The install script calls `curl -fsSL claude.ai/install.sh
Bring-your-own binary	5	5	Documented: set install_claude_code = false and claude_binary_path to point at a pre-installed binary. The "Advanced Configuration" example shows this explicitly.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The install script contacts claude.ai/install.sh and various MCP config URLs, but these are scattered across examples and source code, not consolidated in a network/air-gapped section. Per rubric, scattered mentions earn at most half, but without a dedicated section, score 0.
Runs without sudo	2	2	install.sh.tftpl uses sudo only for writing to /etc/claude-code/managed-settings.d/ with a fallback: if command_exists sudo; then sudo mkdir -p ... else mkdir -p .... Core functionality (installing Claude, configuring .claude.json, adding MCP servers) works without sudo. Full credit per rubric's code-only exception.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Inputs have clear descriptions, sensible defaults (install_claude_code = true, claude_code_version = "latest", workdir = null), and validation blocks for mutual exclusivity (enable_ai_gateway vs anthropic_api_key, use_bedrock vs use_vertex, api_key_helper vs other auth methods, claude_binary_path vs install_claude_code).
Test coverage	4	2	main.tftest.hcl covers business logic (variable validation, conditional resource creation, env var values). main.test.ts covers end-to-end behavior (install script execution, file writes, MCP config, managed settings, api_key_helper). However, test coverage is incomplete: no tests for telemetry OTEL_RESOURCE_ATTRIBUTES merging logic, no tests for mcp_config_remote_path fallback behavior when all URLs fail, no tests for the scripts output ordering. Half credit.

Overall — 61 / 100

---

Scored against SCORECARD.md on 2026-08-12 with claude-sonnet-4-5.