Mux module

[bpmct]

A discussion dedicated to the Mux module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	20 / 25	20 / 20	18 / 20	10 / 10	93 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for all major modes: basic usage, pinned version, custom port, custom package manager, custom registry, cached installation, skip install, restart configuration, project launch, and arbitrary arguments. Each has sensible defaults.
Coder-context framing	8	8	README clearly states "Automatically install and run Mux in a Coder workspace," names both Coder and Mux, and explains Mux is a desktop application for parallel agentic development that runs in Coder workspaces.
Visual preview	5	5	README includes  showing the module in action.

Agent Integration — 20 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No documentation of Coder AI Gateway or Agent Firewall support. The module generates a random auth token for cross-site request protection but this is module-level auth, not AI governance integration.
Dashboard entry point	5	5	coder_app resource configured with proper URL, healthcheck, and customizable display settings (slug, display_name, share, order, group, open_in).
Session continuity	5	5	README documents restart_on_kill feature: "Enable automatic restarts after Mux exits...The launcher waits for restart_delay_seconds, removes ~/.mux/server.lock, and starts Mux again." This provides session continuity across exits and relaunches.
Managed configuration	5	10	README documents managed configuration via add_project (opens specific project on launch), additional_arguments (arbitrary mux server arguments), port, and other settings. Full support for managed Mux configuration.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The module generates random_password.mux_auth_token for authentication. The resource is not marked sensitive = true, but this is a module-generated token, not user-provided. README examples contain no inline secrets or placeholder keys.
Non-hardcoded auth path	4	4	Module generates authentication token automatically via random_password resource, avoiding any need for users to paste keys. The token is process-scoped and passed via environment variable.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	Variable registry_url (default "https://registry.npmjs.org") overrides the npm registry URL used for installation. README example shows: registry_url = "https://npm.pkg.github.com". The install script uses ${REGISTRY_URL} throughout for both package manager installs and tarball downloads.
Bring-your-own binary	5	5	Variable install (default true) disables network installation entirely. README documents: "Skip Install: Run without installing from the network (requires Mux to be pre-installed)" with example setting install = false.
Egress transparency	3	1.5	README Notes section mentions "Requires internet connectivity for agent operations (unless install is set to false)" and lists registry.npmjs.org as default, but lacks a dedicated section enumerating all external endpoints (npm registry, Node.js download from nodejs.org for bootstrap, etc.). Endpoints are scattered across examples and code.
Runs without sudo	2	2	Install and runtime scripts (run.sh) never invoke sudo. All operations use user-writable paths ($HOME/.local/share, /tmp, INSTALL_PREFIX). Verified in source code.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port=4000, install_version="next", package_manager="auto"). Validation blocks for package_manager (enum), restart_delay_seconds (>=0), max_restart_attempts (whole number >=0), share (enum), open_in (enum). Lifecycle precondition prevents use_cached with install=false.
Test coverage	4	4	Comprehensive .tftest.hcl with 20+ test cases covering validation, argument parsing, restart logic, signal handling, package managers, registry URLs. TypeScript tests in main.test.ts cover end-to-end scenarios: default install, tarball fallback, argument parsing, signal-based exits, restart behavior with caps, npm/package manager installs.

Overall — 93 / 100

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.