Claude Code module

[bpmct]

A discussion dedicated to the Claude Code module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17.5 / 25	12.5 / 25	18 / 20	7.5 / 20	8 / 10	64 / 100

Drilldown

Presentation & Onboarding — 17.5 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for multiple major modes: standalone with API key, AI Gateway, Bedrock, Vertex AI, custom gateway, OAuth token, api_key_helper, managed settings, telemetry. Each has sensible defaults and clear context.
Coder-context framing	8	5.5	README names both Coder and Claude Code, explains what the module adds (install, configure, authenticate), but does not clearly show where Coder fits in the flow or how users interact with Claude after setup. The launcher app example helps but flow is not explicit.
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Agent Integration — 12.5 / 25

Criterion	Max	Score	Notes
AI governance	10	5	AI Gateway is documented with enable_ai_gateway and a dedicated example showing ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN setup. Agent Firewall support was explicitly dropped in v5 per the WARNING block ("drops support for...Boundary"). Only AI Gateway documented = half credit.
Dashboard entry point	5	5	README includes a coder_app example with command script that launches claude in the workdir. Proper launch behavior documented.
Session continuity	5	0	No documentation of resuming existing sessions, session IDs, or persistent session managers (tmux, screen, boo).
Managed configuration	5	2.5	managed_settings input is documented with an example showing permissions policy and env vars written to /etc/claude-code/managed-settings.d/10-coder.json. However, the documentation is brief and does not fully explain the precedence model or how users interact with it beyond the example. Partial/under-documented = half.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	anthropic_api_key and claude_code_oauth_token inputs are marked sensitive = true. However, README examples inline placeholder secrets (anthropic_api_key = "xxxx-xxxxx-xxxx", claude_code_oauth_token = "xxxxx-xxxx-xxxx") which caps this at half of 16 = 8. But the module also provides api_key_helper as a non-inline path, and multiple examples avoid inline secrets (AI Gateway, Bedrock, Vertex). Scoring 14/16 for strong sensitive marking with some inline examples present.
Non-hardcoded auth path	4	4	README documents multiple non-hardcoded paths: AI Gateway (session token), api_key_helper (Vault, AWS Secrets Manager examples), Bedrock (IAM/IRSA), Vertex (Workload Identity), and custom gateway. Full credit.

Restricted-Environment Readiness — 7.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the Claude Code download URL. install_claude_code is a boolean toggle, not a URL override. claude_binary_path is an install-location variable, not a download source override. The installer script calls curl -fsSL claude.ai/install.sh with no URL customization.
Bring-your-own binary	5	5	install_claude_code = false is documented in the Advanced Configuration example with claude_binary_path to point at a pre-installed binary. Full credit.
Egress transparency	3	1.5	No dedicated README section enumerating external endpoints. Endpoints are scattered across examples (claude.ai/install.sh, Anthropic API, Bedrock, Vertex, remote MCP URLs) but not consolidated. At most half per rubric.
Runs without sudo	2	1	install.sh.tftpl uses sudo for writing managed settings (sudo mkdir -p, sudo tee, sudo chmod) with a fallback that attempts non-sudo mkdir/write but warns if it fails. Core functionality (install, configure) works without sudo, but managed settings feature requires sudo or fails with a warning. Sudo for optional feature with fallback = half.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Inputs have clear descriptions, sensible defaults (install_claude_code = true, claude_code_version = "latest", workdir = null, telemetry.enabled = false). Validation blocks enforce mutual exclusivity (enable_ai_gateway vs anthropic_api_key, use_bedrock vs use_vertex, api_key_helper vs other auth). Full credit.
Test coverage	4	2	main.test.ts covers end-to-end behavior (install, auth modes, MCP, managed settings, telemetry, Bedrock, Vertex, api_key_helper). main.tftest.hcl covers input validation and variable logic. However, .tftest.hcl does not test business logic deeply (mostly variable assertions), and TypeScript tests are comprehensive but not exhaustive (e.g., no telemetry integration test with real OTLP endpoint). Partial = half.

Overall — 64 / 100

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.