Mux module

[bpmct]

A discussion dedicated to the Mux module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
22 / 25	15 / 25	20 / 20	18 / 20	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 22 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for all major modes: basic usage, pinned version, custom port, custom package manager (npm/pnpm/bun), custom registry, cached installation, skip install, restart behavior, project launch, and arbitrary arguments. Each has sensible defaults.
Coder-context framing	8	8	README clearly states "Automatically install and run Mux in a Coder workspace," names both Coder and Mux, explains Mux is a desktop application for parallel agentic development, and shows Coder provides the workspace infrastructure.
Visual preview	5	2	README includes  but this is a relative path reference, not an embedded image visible in the module's own README context. The rubric requires an actual embedded image, GIF, or video. Partial credit for attempting visual content.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No documentation of Coder AI Gateway or Agent Firewall support. README does not mention how Coder governs auth, routing, or policy enforcement for Mux agents.
Dashboard entry point	5	5	Module includes coder_app resource with proper URL, healthcheck, and configurable display settings (slug, display_name, icon, subdomain, share, order, group, open_in).
Session continuity	5	5	README documents restart behavior: "Enable automatic restarts after Mux exits" with restart_on_kill, restart_delay_seconds, and max_restart_attempts. The launcher removes stale server locks and restarts Mux, enabling session continuity across exits.
Managed configuration	5	5	README documents managed configuration via add_project (opens a project on launch), additional_arguments (arbitrary mux server arguments), port, and the module manages MUX_SERVER_AUTH_TOKEN. Examples show --open-mode pinned --add-project '/workspaces/my repo'.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module generates random_password.mux_auth_token for cross-site request protection. The token is passed via process-scoped environment variable (not a shared coder_env) and included in the app URL query string. No sensitive inputs require user-provided secrets; README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Module generates authentication tokens internally via random_password resource, avoiding any requirement for users to paste raw keys. The auth token is module-managed and process-scoped.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	Variable registry_url (default "https://registry.npmjs.org") overrides the npm registry URL used for both package manager installs and direct tarball downloads. The install script uses ${REGISTRY_URL} throughout: --registry "${REGISTRY_URL}" for package managers, META_URL="${REGISTRY_URL}/mux/$VERSION_TO_USE", and TARBALL_URL="${REGISTRY_URL}/mux/-/mux-$VERSION_TO_USE.tgz".
Bring-your-own binary	5	5	Variable install = false documented in README example "Skip Install" with note "requires Mux to be pre-installed". When false, script checks for existing binary and runs without network access. Also use_cached = true option to prefer existing installation.
Egress transparency	3	1.5	README Notes section mentions "Requires internet connectivity for agent operations (unless install is set to false)" and lists registry/tarball sources, but lacks a dedicated section enumerating all external endpoints (npm registry, nodejs.org for Node bootstrap). Endpoints are scattered across examples and notes.
Runs without sudo	2	2	Inspection of run.sh shows no sudo invocations. All operations (mkdir, curl, tar, ln, npm/pnpm/bun install) run as the calling user. Node bootstrap uses $HOME/.local/share, package installs use user-writable paths.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port=4000, install_version="next", package_manager="auto", registry_url="https://registry.npmjs.org"). Validation blocks present: package_manager enum, restart_delay_seconds >= 0, max_restart_attempts whole number >= 0, share enum, open_in enum.
Test coverage	4	4	Comprehensive .tftest.hcl covers business logic: required vars, validation failures, custom configurations, auth token presence, restart behavior, package manager selection, registry URL handling. TypeScript tests (main.test.ts) cover end-to-end scenarios: default install, tarball fallback, argument parsing, signal-based exits, restart logic with caps, npm/package manager installs.

Overall — 85 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.