Mux module

[bpmct]

A discussion dedicated to the Mux module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	20 / 25	20 / 20	18 / 20	10 / 10	92 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides comprehensive examples covering major modes: basic usage, version pinning, project launch, custom arguments, restart behavior, custom port, package manager selection, custom registry, cached installation, and skip-install mode. Each example includes sensible defaults.
Visual preview	5	5	README embeds mux-product-hero.webp showing the Mux interface in action. Image file verified to exist at 249.1 KB.

Agent Integration — 20 / 25

Criterion	Max	Score	Notes
AI governance	10	5	README mentions Mux is "a desktop application for parallel agentic development" but does not document Coder AI Gateway or Agent Firewall integration. The module generates an auth token for cross-site request protection but this is module-level security, not Coder's AI governance features. Half credit for partial governance through module auth.
Dashboard entry point	5	5	Module includes coder_app resource with proper URL, healthcheck, and configurable display options (subdomain, share, order, group, open_in).
Session continuity	5	5	README explicitly documents restart behavior: "Enable automatic restarts after Mux exits" with restart_on_kill, restart_delay_seconds, and max_restart_attempts variables. The launcher removes stale locks and restarts the server, enabling session continuity across interruptions.
Managed configuration	5	5	README documents managed configuration through add_project (opens specific project on launch) and additional_arguments (passes arbitrary mux server arguments like --open-mode pinned). Examples show configuration management.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module generates random_password.mux_auth_token for authentication. No sensitive inputs are exposed to users. README examples avoid inline secrets entirely—all examples use module-managed authentication.
Non-hardcoded auth path	4	4	Module automatically generates and manages authentication tokens via random_password resource, eliminating the need for users to paste raw keys. The token is passed via process-scoped environment variable and URL query parameter, avoiding template-level credential exposure.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	Variable registry_url (default https://registry.npmjs.org) overrides the npm registry URL used for installation. The install script uses ${REGISTRY_URL} throughout for both package manager installs and tarball downloads. Test custom_registry_url verifies this functionality.
Bring-your-own binary	10	10	Variable install = false disables network installation entirely, requiring pre-installed Mux. README documents: "Skip Install: Run without installing from the network (requires Mux to be pre-installed)". Test install_false_only_success validates this mode.
Egress transparency	3	1.5	README Notes section mentions "Requires internet connectivity for agent operations (unless install is set to false)" and lists registry sources, but lacks a dedicated section enumerating actual endpoints contacted (registry.npmjs.org, nodejs.org for Node bootstrap). Endpoints are scattered across examples and notes rather than consolidated. Half credit.
Runs without sudo	2	2	Install script (run.sh) never invokes sudo. All operations use user-writable paths (/tmp/mux, $HOME/.local/share/coder-mux, $HOME/.mux). Script works entirely as unprivileged user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 4000, install_version "next", restart_delay_seconds 5). Validation rules present for package_manager (enum check), restart_delay_seconds (≥0), max_restart_attempts (≥0 and whole number), share (enum), open_in (enum). Cross-variable validation prevents install=false with use_cached=true.
Test coverage	4	4	Comprehensive .tftest.hcl with 20+ test cases covering validation rules, variable interactions, script content verification, and edge cases. TypeScript tests in main.test.ts cover end-to-end scenarios: default installation, argument parsing, signal-based exits, restart behavior (clean exit and SIGTERM), and npm package manager integration. Tests execute actual scripts in containers.

Overall — 92 / 100

Raw 85 / 92 → round(85 / 92 × 100) = 92 → 93 / 100

Correction: Recalculating: 17 + 20 + 20 + 18 + 10 = 85 out of 92 possible points.
85 / 92 × 100 = 92.39 → rounds to 92 / 100

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.