fix(registry/coder/modules/vscode-web): install extensions when reusing a cached copy

[35C4n0r]

Description

Separate "skip the download" from "skip extensions" so a cached or pre-installed VS Code Web still installs extensions:

• Offline: unchanged. Runs the pre-baked copy and exits, or fails when no copy is present.
• Cached (use_cached): reuse the existing copy, skip only the download, then install extensions and start the server like a fresh install.
• Default: unchanged (always downloads).

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

Path: registry/coder/modules/vscode-web

New version: v1.6.2

Breaking change: [ ] Yes [x] No

Testing & Validation

• Tests pass (bun test)
• Code formatted (bun fmt)
• Changes tested locally

Related Issues

REG-63

---

🤖 Generated by Coder Agents on behalf of @35C4n0r.

[linear-code]

REG-63

[github-actions]

Module Scorecard Check

coder/vscode-web: 82 → 79

⚠️ Score regression: 82 → 79 (-3). Check the drilldown for which criteria dropped.

Theme	Before	After
Presentation & Onboarding	25 / 25	22 / 25
Integration	22 / 25	22 / 25
Credential Hygiene	20 / 20	20 / 20
Restricted-Environment	7 / 20	7 / 20
Engineering Quality	8 / 10	8 / 10
Overall	82 / 100	79 / 100

Full scorecard for this PR

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
22 / 25	22 / 25	20 / 20	7 / 20	8 / 10	79 / 100

Drilldown

Presentation & Onboarding — 22 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom folder installation, extension installation, machine settings configuration, version pinning, workspace opening. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and VS Code Server, explains it installs VS Code Server in a workspace and creates a dashboard app to access it. Shows Coder's role in the flow.
Visual preview	5	2	README references an image () but the actual file is not included in the provided module content, only the reference exists. Half credit would be 2.5, rounding down to 2.

IDE Integration — 22 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource properly configured with healthcheck, subdomain support, and proper URL construction including workspace/folder query parameters.
Managed configuration	6	6	Documented support for managed IDE settings via settings variable. README shows example configuring workbench.colorTheme. Implementation merges settings with existing machine settings using jq or python3 fallback.
Configurable folder or workdir	6	6	Both folder and workspace variables documented with examples. README shows opening custom folder and opening existing workspace file. Validation ensures only one is set.
Pre-installed extensions	6	3	Documented support for pre-installing extensions via extensions variable with example. Also supports auto_install_extensions from workspace recommendations. However, no example shows combining both approaches, and the auto-install feature requires jq which may not be present. Half credit = 3.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. VS Code Server license acceptance is boolean, not a secret. No API keys or credentials required.
Non-hardcoded auth path	4	4	Module uses --without-connection-token and --accept-server-license-terms flags. No credential management needed; authentication handled by Coder's app proxy.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable overrides the download URL. The script hardcodes https://update.code.visualstudio.com/api/commits/... and https://vscode.download.prss.microsoft.com/.... The commit_id variable pins a version but does not change the source URL. install_prefix only changes the destination directory.
Bring-your-own binary	5	5	use_cached variable documented with example: "Uses cached copy of VS Code Web in the background, otherwise fetches it from internet." Script checks for existing binary and skips download when use_cached=true.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The URLs appear only in source code (run.sh). Endpoints are inferable but not documented per rubric requirements.
Runs without sudo	2	2	Inspected run.sh: no sudo invocations anywhere. Script uses mkdir, curl, tar, base64, jq/python3 (optional), all as unprivileged user. Full credit from code verification alone per rubric exception.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults throughout (port 13338, telemetry_level "error", share "owner"). Validation blocks on accept_license, share values, telemetry_level values, open_in values, platform values, and mutual exclusivity of offline/use_cached and workspace/folder.
Test coverage	4	2	TypeScript tests in main.test.ts cover settings merging (jq, python3, neither), extension installation, JSONC parsing, workspace vs extensions.json, cached mode. However, .tftest.hcl only tests open_in validation, missing business logic coverage for other preconditions and variable interactions. Half credit = 2.

Overall — 79 / 100

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.