Claude Code module

[bpmct]

A discussion dedicated to the Claude Code module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	15 / 25	12 / 20	11 / 20	10 / 10	65 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents 8+ auth modes (API key, OAuth, AI Gateway, Bedrock, Vertex, Foundry, custom gateway, api_key_helper) each with a full Terraform example and sensible defaults. Advanced Configuration, Telemetry, and managed-settings examples round out coverage.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field is a module-listing icon, not a visual preview of the module in action.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	anthropic_api_key, claude_code_oauth_token, foundry_api_key, and foundry_auth_token all carry sensitive = true in main.tf. However, README examples repeatedly inline placeholder keys (e.g. anthropic_api_key = "xxxx-xxxxx-xxxx"), which caps this criterion at half per calibration.
Non-hardcoded auth path	4	4	Multiple documented non-raw-key paths: api_key_helper (Vault / AWS Secrets Manager), Coder AI Gateway (session token), AWS IRSA / instance profile, GCP Workload Identity / ADC, Azure managed identity / Entra ID. All have dedicated README sections.

Restricted-Environment Readiness — 11 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The installer URL https://claude.ai/install.sh is hardcoded in scripts/install.sh.tftpl. No module input variable overrides this download URL. claude_code_version pins a version argument, not the URL; claude_binary_path is an install-location variable, not a download-URL override.
Bring-your-own binary	10	10	install_claude_code = false skips the installer entirely, and claude_binary_path points to a pre-installed binary. Documented in the "Advanced Configuration" example with the note: "Skip the module's installer and point at a pre-installed Claude binary."
Egress transparency	3	0	No dedicated README section enumerates external endpoints contacted at install or runtime. Endpoints (claude.ai/install.sh, Anthropic API, AI Gateway, Bedrock, Vertex, Foundry, OTLP) appear only within configuration examples, not in a consolidated network/air-gapped section.
Runs without sudo	2	1	Core install (download to $HOME/.local/bin, ~/.claude.json config) works without sudo. Sudo is invoked only for optional features: writing /etc/claude-code/managed-settings.d/ (managed_settings, api_key_helper registration) and removing stale files. setup_api_key_helper has a graceful fallback (warns and continues); write_managed_settings will fail hard under set -e if the directory is unwritable without sudo, but this is an optional feature. Half credit for optional-feature sudo with partial fallback.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Every variable has a description, sensible defaults (install_claude_code = true, claude_code_version = "latest", workdir = null), and extensive validation blocks (12+ validation rules across enable_ai_gateway, use_bedrock, use_vertex, use_foundry, api_key_helper, authentication_config, anthropic_base_url, claude_binary_path).
Test coverage	4	4	main.tftest.hcl contains 30+ plan tests covering variable interactions, env-var creation, mutual-exclusion validations, and script-output ordering (business logic). main.test.ts contains 25+ container-based e2e tests verifying install success/failure paths, file contents, CLI invocations, cleanup behavior, and provider-specific env vars.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	5	Coder AI Gateway is fully documented (enable_ai_gateway = true, dedicated section, authentication_config option, mutual-exclusion validation). Agent Firewall (Boundary) support is explicitly dropped in v5 per the WARNING block: "v5 is a major refactor that drops support for Coder Tasks and Boundary." Per calibration, dropped support counts as absent. Exactly one of two documented → half.
Dashboard entry point	5	5	"Standalone mode with a launcher app" example provides a complete coder_app resource with open_in = "slim-window", a bash command that cds to the workdir and launches claude.
Session continuity	5	0	No README section documents resuming an existing Claude Code session, session-ID persistence, or running inside a persistent session manager (tmux, screen, boo). The module installs and configures the CLI but does not address session continuity.
Managed configuration	5	5	managed_settings input writes a highest-precedence policy file to /etc/claude-code/managed-settings.d/10-coder.json (documented with full example and schema reference). MCP servers are configurable via mcp (inline JSON) and mcp_config_remote_path (remote URLs). api_key_helper provides managed credential injection.

Overall — 65 / 100

Raw 60 / 92 → round(60 / 92 × 100) = 65

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.