Mux module

[bpmct]

A discussion dedicated to the Mux module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
22 / 25	15 / 25	20 / 20	18 / 20	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 22 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for all major modes: basic usage, pinned version, custom port, custom package manager (npm/pnpm/bun), custom registry, cached installation, skip install, restart behavior, project launch, and arbitrary arguments. Each has sensible defaults.
Coder-context framing	8	8	Opening paragraph explains "Automatically install and run Mux in a Coder workspace," names both Coder and Mux, describes what Mux adds (parallel agentic development), and shows Coder's role in the flow.
Visual preview	5	2	README includes  but this is a relative path to a product hero image, not embedded inline. The rubric requires an actual embedded image, GIF, or video visible in the README. Partial credit for attempting visual content.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No documentation of Coder AI Gateway or Agent Firewall support. The module generates a per-instance auth token (MUX_SERVER_AUTH_TOKEN) for cross-site request protection, but this is module-level auth, not AI Gateway or Agent Firewall integration.
Dashboard entry point	5	5	coder_app resource defined in main.tf with proper URL, healthcheck, and configurable display settings (slug, share, order, group, open_in).
Session continuity	5	5	README documents restart behavior: "Enable automatic restarts after Mux exits" with restart_on_kill, restart_delay_seconds, and max_restart_attempts. The launcher removes stale server locks and restarts the process, enabling session continuity across crashes and intentional shutdowns.
Managed configuration	5	5	README documents add_project to open a project on launch and additional_arguments to pass arbitrary mux server arguments for managed configuration. Examples show --open-mode pinned --add-project '/workspaces/my repo'.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The module generates random_password.mux_auth_token for authentication. No user-supplied secrets are required. README examples avoid inline secrets entirely.
Non-hardcoded auth path	4	4	Module generates per-instance auth tokens via random_password resource, avoiding any need for users to paste keys. The token is passed via process-scoped environment variable and URL query parameter.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	registry_url variable (default https://registry.npmjs.org) overrides the npm registry URL used for installation. README example: "Use a private or mirrored npm registry" with registry_url = "https://npm.pkg.github.com". The install script uses ${REGISTRY_URL} throughout for both package manager installs and tarball downloads.
Bring-your-own binary	5	5	install = false variable documented with example: "Run without installing from the network (requires Mux to be pre-installed)". The script checks OFFLINE flag and skips installation when true.
Egress transparency	3	1.5	No dedicated README section enumerating external endpoints. Endpoints are scattered across examples (registry.npmjs.org, nodejs.org for Node bootstrap) and inferable from code, but not consolidated in a network/air-gapped section. Partial credit for mentioning "Requires internet connectivity for agent operations (unless install is set to false)" in Notes.
Runs without sudo	2	2	Install and runtime scripts (run.sh) never invoke sudo. All operations use user-writable paths ($HOME/.local/share, /tmp, $INSTALL_PREFIX). Node bootstrap, package manager installs, and mux execution all run as unprivileged user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port=4000, install_version="next", package_manager="auto"). Validation blocks for package_manager (enum), restart_delay_seconds (>=0), max_restart_attempts (whole number >=0), share (enum), open_in (enum).
Test coverage	4	4	Comprehensive .tftest.hcl with 20+ test cases covering validation, script generation, auth token handling, restart logic, package manager selection, and registry URL. TypeScript tests (main.test.ts) cover end-to-end scenarios: default install, tarball fallback, argument parsing, signal-based exits, restart behavior with caps, and package manager detection.

Overall — 85 / 100

---

Scored against SCORECARD.md on 2026-07-20 with claude-sonnet-4-5.