Mux module

[bpmct]

A discussion dedicated to the Mux module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
22 / 25	20 / 25	20 / 20	18 / 20	10 / 10	90 / 100

Drilldown

Presentation & Onboarding — 22 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for all major modes: basic usage, pinned version, custom port, custom package manager, custom registry, cached installation, skip install, restart configuration, project launch, and arbitrary arguments. Each has sensible defaults.
Coder-context framing	8	8	README clearly explains Mux as a desktop application for parallel agentic development, states it runs in a Coder workspace, and describes how developers use it within the workspace environment.
Visual preview	5	2	README includes  but this is a relative path reference, not an embedded image visible in the module's own README context. The rubric requires an actual embedded image, GIF, or video. Partial credit for attempting visual documentation.

Agent Integration — 20 / 25

Criterion	Max	Score	Notes
AI governance	10	5	README mentions "Cost Tracking: Monitor API usage across agents" in features but does not document Coder AI Gateway or Agent Firewall integration. The module generates a per-instance auth token (MUX_SERVER_AUTH_TOKEN) for cross-site request protection, which provides some governance, but neither AI Gateway nor Agent Firewall are explicitly documented. Half credit for partial governance via auth token.
Dashboard entry point	5	5	Module includes coder_app resource with proper URL, healthcheck, and configurable display settings (slug, share, order, group, open_in).
Session continuity	5	5	README explicitly documents restart functionality: "Enable automatic restarts after Mux exits" with restart_on_kill, restart_delay_seconds, and max_restart_attempts variables. The launcher removes stale locks and restarts the server, enabling session continuity across exits.
Managed configuration	5	5	README documents add_project to open a project on launch and additional_arguments for passing arbitrary mux server arguments, enabling managed configuration of the agent's startup behavior and workspace settings.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module generates random_password.mux_auth_token for authentication. No sensitive inputs are exposed to users. README examples avoid inline secrets entirely.
Non-hardcoded auth path	4	4	Module generates a per-instance auth token via random_password resource, avoiding any need for users to paste keys. The token is passed via process-scoped environment variable and URL query parameter.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	Variable registry_url (default https://registry.npmjs.org) overrides the npm registry URL used for installation. The script uses ${REGISTRY_URL} throughout install paths for both package manager installs and tarball downloads.
Bring-your-own binary	5	5	Variable install = false documented in "Skip Install" example: "Run without installing from the network (requires Mux to be pre-installed)". Script checks OFFLINE flag and skips installation entirely.
Egress transparency	3	1.5	README "Notes" section mentions "Requires internet connectivity for agent operations (unless install is set to false)" and lists registry.npmjs.org implicitly through examples, but lacks a dedicated section enumerating all external endpoints (npm registry, Node.js download URL nodejs.org/dist). Partial credit for scattered mentions.
Runs without sudo	2	2	Inspected run.sh: no sudo invocations anywhere. Script uses user-writable paths (/tmp/mux, $HOME/.local/share/coder-mux, $HOME/.mux). Full credit from code verification alone per rubric exception.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 4000, install_version "next", package_manager "auto"). Validation blocks present for package_manager (enum check), share (enum check), open_in (enum check), restart_delay_seconds (>= 0), max_restart_attempts (>= 0 and whole number). Lifecycle precondition prevents use_cached with install = false.
Test coverage	4	4	.tftest.hcl covers business logic: required vars, conflicting flags, custom ports, auth token presence, argument parsing, restart behavior, validation failures, package manager selection, registry URL handling. TypeScript tests in main.test.ts cover end-to-end scenarios: default install, tarball fallback, argument parsing, signal-based exit logging, restart after clean exit, restart after SIGTERM, npm-based install.

Overall — 90 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.