Claude Code module

[bpmct]

A discussion dedicated to the Claude Code module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	10 / 25	10 / 20	7 / 20	8 / 10	51 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for multiple major modes: standalone with API key, AI Gateway, Bedrock, Vertex AI, custom gateway, OAuth token, api_key_helper, managed settings, telemetry. Each has sensible defaults and clear configuration.
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Agent Integration — 10 / 25

Criterion	Max	Score	Notes
AI governance	10	5	AI Gateway documented with enable_ai_gateway and authentication_config examples. Agent Firewall explicitly removed in v5 per WARNING block: "v5 is a major refactor that drops support for...Boundary. We plan to add Boundary support back in a follow-up." Only one governance mechanism documented = half credit.
Dashboard entry point	5	5	README "Standalone mode with a launcher app" example shows coder_app with command launching claude in workdir.
Session continuity	5	0	No documentation of resuming sessions, session IDs, or persistent session managers (tmux/screen/boo).
Managed configuration	5	0	managed_settings writes policy to /etc/claude-code/managed-settings.d/ but this is enterprise policy enforcement, not managed MCP/settings/workdir config in the sense of the rubric (which asks for managed IDE settings or config). MCP servers are added but not managed centrally. workdir pre-creates directory and accepts trust dialog but does not manage ongoing configuration.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	anthropic_api_key and claude_code_oauth_token marked sensitive = true. However, README examples inline placeholder secrets: anthropic_api_key = "xxxx-xxxxx-xxxx" and claude_code_oauth_token = "xxxxx-xxxx-xxxx" throughout. Per rubric: "README examples avoid inline secrets" required for full; inline placeholders cap at half.
Non-hardcoded auth path	4	2	api_key_helper documented for Vault/AWS Secrets Manager short-lived credentials. AI Gateway uses session token. Bedrock/Vertex use cloud IAM. However, primary examples still show direct API key input. Non-hardcoded paths exist but are not the primary/default pattern = half credit.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No module input variable overrides the Claude Code installer download URL (https://claude.ai/install.sh is hardcoded in install.sh.tftpl). claude_binary_path only sets where to find an already-installed binary, not where to download from. Version pinning (claude_code_version) is not a URL override.
Bring-your-own binary	10	5	install_claude_code = false documented in "Advanced Configuration" example with claude_binary_path pointing to pre-installed location. However, documentation is brief (one example block) and does not detail image-baking workflows or validation behavior = half credit.
Egress transparency	3	1.5	No dedicated README section for restricted/air-gapped environments. Endpoints scattered: https://claude.ai/install.sh in code, AI Gateway endpoint constructed in examples, mcp_config_remote_path URLs in examples. Anthropic API endpoint inferable but not enumerated. At most half per rubric; actual = half.
Runs without sudo	2	0.5	install.sh.tftpl uses sudo for writing managed settings: "if command_exists sudo; then sudo mkdir -p... sudo tee... sudo chmod..." Core functionality (managed_settings, api_key_helper registration) requires sudo for /etc/claude-code/ writes. Fallback exists ("else mkdir -p") but only works if /etc/claude-code is already writable, not a true no-sudo path for core features = half credit per rubric.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Inputs have clear descriptions, sensible defaults (install_claude_code = true, claude_code_version = "latest", authentication_config = "environment"). Comprehensive validation blocks: enable_ai_gateway mutual exclusions, use_bedrock/use_vertex conflicts, api_key_helper exclusions, authentication_config enum, claude_binary_path conditional.
Test coverage	4	2	main.tftest.hcl covers business logic: authentication modes, validation rules, managed settings, telemetry, script outputs. main.test.ts covers end-to-end: install pipeline, curl mocking, installer failures, MCP config, standalone mode, api_key_helper. However, test coverage is partial: no tests for mcp_config_remote_path failure handling edge cases, telemetry header formatting, or multi-script serialization via scripts output in TypeScript = half credit.

Overall — 51 / 100

Raw 47 / 92 → round(47 / 92 × 100) = 51

---

Scored against SCORECARD.md on 2026-09-10 with claude-sonnet-4-5.