chore(coder-labs/templates/tasks-docker): remove the Tasks on Docker template - #1045
Conversation
…template Coder Tasks is deprecated as of Coder v2.36 and is hidden by default, so this template cannot be used on a default deployment. Remove the template, its orphaned screenshot, and the two references that pointed at it.
…warnings Coder Tasks is deprecated as of Coder v2.36. Remove the Tasks docs links, the coder_ai_task and coder_task provider entries, and the task-oriented templates section from the templates skill. In the claude-code and codex upgrade warnings, unlink the deleted Tasks docs page and scope the follow-up promise to Boundary only.
Module Scorecard Check
|
| Presentation & Onboarding | Agent Integration | Credential Hygiene | Restricted-Environment Readiness | Engineering Quality | Overall |
|---|---|---|---|---|---|
| 17 / 25 | 15 / 25 | 18 / 20 | 0 / 20 | 8 / 10 | 58 / 100 |
Drilldown
Presentation & Onboarding — 17 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Configuration-mode examples | 12 | 12 | README provides examples for standalone mode with launcher app, AI Gateway usage, and advanced configuration with MCP servers. Each major mode (standalone with API key, AI Gateway, custom config) has a documented example with sensible defaults. |
| Coder-context framing | 8 | 5 | README names both Coder and Codex CLI, shows Coder-specific integration (AI Gateway, coder_app), but lacks explicit explanation of what the module adds on top of Coder or where Coder fits in the overall flow. The opening line "Install and configure the Codex CLI in your workspace" is minimal framing. |
| Visual preview | 5 | 0 | No image, GIF, or video in README. Only an icon reference in frontmatter. |
Agent Integration — 15 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| AI governance | 10 | 5 | AI Gateway is documented with dedicated example and configuration details. Agent Firewall support was explicitly dropped in v5 per the WARNING block: "v5 is a major refactor that drops support for Coder Tasks and Boundary." Only AI Gateway documented = half credit. |
| Dashboard entry point | 5 | 5 | README includes a complete coder_app example with slug, display_name, icon, open_in, and command. The example shows proper launch behavior for interactive Codex sessions. |
| Session continuity | 5 | 0 | README NOTE mentions that coder_app command re-executes on reconnect and suggests using tmux/screen for one-shot commands, but does not document how to actually configure or use session continuity. No example of resuming sessions or persistent session manager integration. |
| Managed configuration | 5 | 5 | Extensive documentation of managed MCP configuration via mcp variable, mcp_config_remote_path for remote TOML configs, base_config_toml for custom settings, and workdir trust configuration. Multiple examples show managed config in action. |
Credential Hygiene — 18 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Secrets marked sensitive | 16 | 14 | openai_api_key variable is marked sensitive = true in main.tf. However, README examples show openai_api_key = var.openai_api_key which could encourage inline secrets if users don't understand variable indirection. The pattern is better than literal keys but not explicitly cautioned against. Half point deduction for ambiguous guidance. |
| Non-hardcoded auth path | 4 | 4 | AI Gateway example demonstrates OAuth-style authentication using workspace owner's session token, avoiding raw API keys entirely. This is a documented alternative path that doesn't require pasting keys into templates. |
Restricted-Environment Readiness — 0 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Mirrorable artifact source | 10 | 0 | No module variable overrides the Codex download URL. The install script hardcodes https://github.com/openai/codex/releases/... with no input to redirect it to an internal mirror. codex_version only controls which version is fetched from the hardcoded GitHub URL. |
| Bring-your-own binary | 5 | 0 | install_codex = false skips installation but README states "Skipping Codex installation as per configuration" without documenting how to use a pre-installed binary or what the expected path should be. No documented workflow for baking Codex into the image. |
| Egress transparency | 3 | 0 | No dedicated README section enumerating external endpoints. GitHub releases URL is visible in examples but not consolidated. MCP remote fetch endpoints are user-provided. No air-gapped or restricted environment guidance. |
| Runs without sudo | 2 | 0 | Install script in install.sh.tftpl never invokes sudo and installs to $HOME/.local/bin, but the script uses curl and tar which may not be available in all unprivileged environments. The script does not check for or handle missing dependencies gracefully. However, the core install path itself does not require root. Re-examining: the script runs without sudo for core functionality (installs to user home). Full credit = 2. Revising score. |
Revision for Runs without sudo: Install script installs to $HOME/.local/bin, uses mktemp, curl, tar, mv, chmod without sudo. No sudo invocation found in install.sh.tftpl. Script works as unprivileged user for core functionality. Score: 2.
Restricted-Environment Readiness — 2 / 20 (Revised)
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Mirrorable artifact source | 10 | 0 | No module variable overrides the Codex download URL. The install script hardcodes https://github.com/openai/codex/releases/... with no input to redirect it to an internal mirror. codex_version only controls which version is fetched from the hardcoded GitHub URL. |
| Bring-your-own binary | 5 | 0 | install_codex = false skips installation but README states "Skipping Codex installation as per configuration" without documenting how to use a pre-installed binary or what the expected path should be. No documented workflow for baking Codex into the image. |
| Egress transparency | 3 | 0 | No dedicated README section enumerating external endpoints. GitHub releases URL is visible in examples but not consolidated. MCP remote fetch endpoints are user-provided. No air-gapped or restricted environment guidance. |
| Runs without sudo | 2 | 2 | Install script (install.sh.tftpl) installs to $HOME/.local/bin and never invokes sudo. Uses standard unprivileged commands (curl, tar, mktemp, mv, chmod). Works as unprivileged user. |
Engineering Quality — 8 / 10
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Input quality | 6 | 4 | Most inputs have clear descriptions. base_config_toml has detailed multi-line description. model_reasoning_effort has validation. However, several inputs lack validation: codex_version accepts any string (no format check), mcp_config_remote_path accepts any URL list (no validation), workdir accepts any string (no path validation). Defaults are sensible where provided. |
| Test coverage | 4 | 4 | Comprehensive test coverage. main.test.ts has 30+ test cases covering install paths, config generation, AI Gateway, MCP servers, idempotency, and marker-block semantics. main.tftest.hcl covers basic plans, API key handling, AI Gateway validation, script outputs. Tests cover both business logic (Terraform) and end-to-end behavior (TypeScript). |
Overall — 58 / 100
coder-labs/opencode: first scorecard, 51 / 100
No specific score is required to contribute, but modules with higher scores are more likely to be approved by the Coder team and widely used.
Full scorecard for this PR
| Presentation & Onboarding | Agent Integration | Credential Hygiene | Restricted-Environment Readiness | Engineering Quality | Overall |
|---|---|---|---|---|---|
| 12.5 / 25 | 20 / 25 | 10 / 20 | 0 / 20 | 8 / 10 | 51 / 100 |
Drilldown
Presentation & Onboarding — 12.5 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Configuration-mode examples | 12 | 12 | README provides "Basic Usage" example with auth and config, and "Standalone CLI Mode" example showing report_tasks=false and cli_app=true. Covers major modes with sensible defaults. |
| Coder-context framing | 8 | 0.5 | Mentions "integrates with AgentAPI for seamless task reporting in the Coder UI" but does not explain what the module adds on top of Coder, nor show where Coder fits in the flow. Minimal framing. |
| Visual preview | 5 | 0 | No image, GIF, or video in README. Icon reference does not count. |
Agent Integration — 20 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| AI governance | 10 | 5 | README mentions "Coder AI Agents Guide" link but provides no documented support for AI Gateway or Agent Firewall. The module configures a Coder MCP server for task reporting, not governance. Half credit for partial AI integration context. |
| Dashboard entry point | 5 | 5 | Uses agentapi module which provides coder_app support. Web app and optional CLI app are documented in examples. |
| Session continuity | 5 | 5 | Documented support for continuing sessions via continue variable and session_id variable. README example shows continue = true and session_id usage. |
| Managed configuration | 5 | 5 | Documented support for managed config via config_json variable for OpenCode JSON config and auth_json for authentication. Examples show MCP server configuration. |
Credential Hygiene — 10 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Secrets marked sensitive | 16 | 8 | Variables auth_json and config_json are NOT marked sensitive = true in main.tf. README "Basic Usage" example shows inline API keys in auth_json (gem-xxx-xxxx, sk-ant-api03-xxx). Inline secrets in examples cap this at half. |
| Non-hardcoded auth path | 4 | 2 | README mentions auth.json file location but examples show pasting keys into templates. No documented path avoiding raw keys (no OAuth, IAM, or external auth helper shown). Partial credit for mentioning file-based auth. |
Restricted-Environment Readiness — 0 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Mirrorable artifact source | 10 | 0 | No module variable overrides the OpenCode download URL. The install script hardcodes curl -fsSL https://opencode.ai/install. Version variable exists but does not change the download source URL. |
| Bring-your-own binary | 5 | 0 | Variable install_opencode exists but is not documented in README as a way to skip installation when tool is pre-baked. No documented BYOB path. |
| Egress transparency | 3 | 0 | No dedicated README section enumerating external endpoints. Endpoints are inferable from code (opencode.ai/install, nodesource.com in example) but not documented. |
| Runs without sudo | 2 | 0 | install.sh does not use sudo, but the Basic Usage example shows pre_install_script with sudo apt-get install -y nodejs and sudo -E bash. Core example requires sudo. |
Engineering Quality — 8 / 10
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Input quality | 6 | 6 | Variables have clear descriptions, sensible defaults (install_opencode=true, report_tasks=true, opencode_version="latest"). No validation blocks but types are appropriate. |
| Test coverage | 4 | 2 | Comprehensive TypeScript tests in main.test.ts cover end-to-end behavior (15+ test cases). Terraform tests in main.tftest.hcl cover defaults and variable configurations but focus on variable passthrough rather than business logic. Half credit for good TS coverage but limited TF business logic testing. |
Overall — 51 / 100
coder/claude-code: 64 → 61
| Theme | Before | After |
|---|---|---|
| Presentation & Onboarding | 17.5 / 25 | 17.5 / 25 |
| Integration | 12.5 / 25 | 10 / 25 |
| Credential Hygiene | 18 / 20 | 18 / 20 |
| Restricted-Environment | 7.5 / 20 | 7.5 / 20 |
| Engineering Quality | 8 / 10 | 8 / 10 |
| Overall | 64 / 100 | 61 / 100 |
Full scorecard for this PR
| Presentation & Onboarding | Agent Integration | Credential Hygiene | Restricted-Environment Readiness | Engineering Quality | Overall |
|---|---|---|---|---|---|
| 17.5 / 25 | 10 / 25 | 18 / 20 | 7.5 / 20 | 8 / 10 | 61 / 100 |
Drilldown
Presentation & Onboarding — 17.5 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Configuration-mode examples | 12 | 12 | README provides documented examples for major modes: standalone with API key, AI Gateway, Bedrock, Vertex AI, custom gateway, OAuth token, api_key_helper, managed settings, telemetry. Each has sensible defaults and clear context. |
| Coder-context framing | 8 | 5.5 | README names both Coder and Claude Code, explains what the module adds (install, configure, authenticate), but does not clearly show where Coder fits in the flow (e.g., workspace lifecycle, agent startup sequence). The framing is present but could be stronger. |
| Visual preview | 5 | 0 | No image, GIF, or video in README. Icon reference does not count. |
Agent Integration — 10 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| AI governance | 10 | 5 | AI Gateway support is documented with enable_ai_gateway and examples. Agent Firewall support was explicitly dropped in v5 per the WARNING callout ("drops support for...Boundary"). Only one of two governance mechanisms documented = half credit. |
| Dashboard entry point | 5 | 5 | coder_app example provided in "Standalone mode with a launcher app" section with proper command, icon, and open_in configuration. |
| Session continuity | 5 | 0 | No documentation of resuming sessions, session IDs, or persistent session managers (tmux, screen, boo). Claude Code runs interactively but session continuity is not addressed. |
| Managed configuration | 5 | 0 | managed_settings documents policy enforcement (permissions, deny lists) but not managed MCP, workdir, or settings in the sense of pre-configuring the agent's operational parameters. The managed_settings example shows security policy, not operational configuration management. MCP servers are added at user scope, not managed/enforced scope. |
Credential Hygiene — 18 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Secrets marked sensitive | 16 | 14 | anthropic_api_key and claude_code_oauth_token inputs are marked sensitive = true. However, README examples inline placeholder secrets (anthropic_api_key = "xxxx-xxxxx-xxxx") which caps this at partial credit per rubric. |
| Non-hardcoded auth path | 4 | 4 | api_key_helper example shows Vault and AWS Secrets Manager integration for short-lived credentials. AI Gateway uses workspace owner session token. OAuth token generation via claude setup-token. Multiple non-hardcoded paths documented. |
Restricted-Environment Readiness — 7.5 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Mirrorable artifact source | 10 | 0 | No module input variable overrides the Claude Code download URL. The install script calls curl -fsSL claude.ai/install.sh with no URL override mechanism. claude_code_version pins the version but does not change the source URL. |
| Bring-your-own binary | 5 | 5 | install_claude_code = false with claude_binary_path documented in "Advanced Configuration" example. Module skips download when install_claude_code is false and uses the provided path. |
| Egress transparency | 3 | 1.5 | No dedicated README section for restricted/air-gapped environments. Endpoints are scattered across examples (claude.ai/install.sh, Anthropic API, AI Gateway, Bedrock, Vertex, remote MCP URLs) but not enumerated in one place. Partial credit for inferable endpoints. |
| Runs without sudo | 2 | 1 | install.sh.tftpl uses sudo for writing managed settings (lines: sudo mkdir -p, sudo tee, sudo chmod) but has a fallback path (lines: elif mkdir -p "$${dropin_dir}" 2> /dev/null). Sudo is used for optional managed settings feature with working fallback = half credit. |
Engineering Quality — 8 / 10
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Input quality | 6 | 6 | Inputs have clear descriptions, sensible defaults (install_claude_code = true, claude_code_version = "latest", workdir = null). Validation blocks present for mutually exclusive options (enable_ai_gateway vs anthropic_api_key, use_bedrock vs use_vertex, etc.). |
| Test coverage | 4 | 2 | main.tftest.hcl covers input validation and basic plan assertions. main.test.ts has comprehensive end-to-end tests (happy-path, install, auth modes, MCP, scripts, telemetry, Bedrock, Vertex, api_key_helper). However, .tftest.hcl does not cover business logic deeply (mostly variable passthrough checks), and TypeScript tests are thorough but the split is unbalanced. Partial credit. |
Overall — 61 / 100
harleylrn/kiro-cli: first scorecard, 89 / 100
No specific score is required to contribute, but modules with higher scores are more likely to be approved by the Coder team and widely used.
Full scorecard for this PR
| Presentation & Onboarding | Agent Integration | Credential Hygiene | Restricted-Environment Readiness | Engineering Quality | Overall |
|---|---|---|---|---|---|
| 25 / 25 | 20 / 25 | 18 / 20 | 18 / 20 | 8 / 10 | 89 / 100 |
Drilldown
Presentation & Onboarding — 25 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Configuration-mode examples | 12 | 12 | Multiple documented examples: basic usage, custom AI prompt, pre/post install scripts, specific version installation, custom agent configuration, custom AgentAPI configuration, and air-gapped installation. Each example shows sensible defaults and different operational modes. |
| Coder-context framing | 8 | 8 | README clearly explains "Run Kiro CLI in your workspace to access AI coding assistant" and "This module provides a complete integration with Coder workspaces, including automatic installation, MCP (Model Context Protocol) integration for task reporting." Shows Coder fits in the flow via AgentAPI and MCP integration. |
| Visual preview | 5 | 5 | README includes  and the image file exists (330.1 KB verified). |
Agent Integration — 20 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| AI governance | 10 | 5 | Documents Coder MCP integration for task reporting with instructions and allowed tools configuration. No mention of Agent Firewall. AI Gateway not documented. Only MCP server integration documented, earning half credit. |
| Dashboard entry point | 5 | 5 | Module uses agentapi module which provides web_app_slug, web_app_display_name, web_app_icon, web_app_order, web_app_group and optional cli_app support. README shows "Provide web interface through AgentAPI" and documents AgentAPI configuration. |
| Session continuity | 5 | 5 | README documents that agentapi manages "the interactive session" and the start script uses agentapi server to wrap kiro-cli chat, providing session management. The agentapi module provides session continuity across reconnects. |
| Managed configuration | 5 | 5 | Extensive documentation of managed configuration: agent_config variable for custom agent JSON, system_prompt for AI behavior, coder_mcp_instructions for MCP integration, default agent configuration template, and workdir configuration. README shows multiple examples of configuration management. |
Credential Hygiene — 18 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Secrets marked sensitive | 16 | 14 | auth_tarball variable marked sensitive = true in main.tf. However, README examples show placeholder values like auth_tarball = "PASTE_YOUR_TARBALL_HERE" and inline base64 strings in examples, which count as inline secrets. This caps the score at 14 (7/8 of full). |
| Non-hardcoded auth path | 4 | 4 | README documents generating authentication tarball from pre-authenticated local machine: "Install Kiro CLI and login on your local machine" then "Generate the authentication tarball" from ~/.local/share/kiro-cli. This avoids pasting raw API keys into templates. |
Restricted-Environment Readiness — 18 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Mirrorable artifact source | 10 | 10 | kiro_install_url variable (default https://desktop-release.q.us-east-1.amazonaws.com) overrides the download URL. README documents air-gapped installation example: "Point to internal artifact repository" with kiro_install_url = "https://artifacts.internal.corp/kiro-cli-releases". |
| Bring-your-own binary | 5 | 5 | install_kiro_cli variable (default true) can be set to false to disable installation. README documents this in "Install options configuration" and start script checks for existing kiro-cli: "If we have an AI prompt..." and finds binary via command_exists kiro-cli or $HOME/.local/bin/kiro-cli. |
| Egress transparency | 3 | 1.5 | Air-gapped installation section mentions downloading from official source and hosting internally, but no dedicated section enumerating actual endpoints contacted. Endpoints scattered across examples (kiro_install_url default, AWS S3 domain). No comprehensive list of runtime endpoints. |
| Runs without sudo | 2 | 1.5 | Install script uses ./kirocli/install.sh --no-confirm which may require elevated privileges. Pre-install script example shows sudo apt-get update && sudo apt-get install -y zstd. Start script runs without sudo. Core functionality may work without sudo but installation path unclear, earning half credit. |
Engineering Quality — 8 / 10
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Input quality | 6 | 4 | Most inputs have clear descriptions. Some lack validation: auth_tarball has no format validation, agent_config has no JSON validation in variables (only runtime parsing), kiro_install_url has no URL validation. Sensible defaults present for most variables. |
| Test coverage | 4 | 4 | Comprehensive .tftest.hcl with 13 test runs covering required variables, minimal config, three documented test cases matching CDES-203, full config, auth tarball handling, system prompts, install options, versions, agent name extraction, and JSON encoding. TypeScript main.test.ts with 16 end-to-end tests covering all three documented test cases plus edge cases. Clear testing story. |
Overall — 89 / 100
Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.
…eprecated Drop the link to the deleted Coder Tasks docs page and warn that the wiring only applies to Coder versions before v2.36. The module still exposes task_app_id and report_tasks, so the example stays for those deployments.
|
-### Basic Usage with Tasks
+### Basic Usage
```tf
-resource "coder_ai_task" "task" {
- app_id = module.opencode.task_app_id
-}
-
module "opencode" {
source = "registry.coder.com/coder-labs/opencode/coder"
version = "0.1.2"
agent_id = coder_agent.main.id
workdir = "/home/coder/project"
- ai_prompt = coder_ai_task.task.prompt
-
auth_json = <<-EOTAlso drop the Everything else still has Tasks plumbing in Terraform and hasn't been upgraded to drop support: Two smaller things: |
Similar to my comment in Slack about Kiro, I'm gonna opt not to touch the other modules that you mentioned. It felt much more invasive of a change and I'm really not familiar with the registry process. Can work with you to get the changes done next week, but not wanting them in this PR. Thanks! |
Related: coder/coder#28008, which deprecates Coder Tasks as of Coder v2.36, hides it behind the internal
CODER_ENABLE_AI_TASKSflag, and removes the Tasks docs and the equivalent in-repo example template.Removes the
coder-labs/tasks-dockertemplate and the Coder Tasks guidance that pointed at it.The template exists only to demo Coder Tasks: it declares
coder_ai_taskand readsdata "coder_task". On a v2.36 deployment with default settings the Tasks UI,/tasksroutes and Tasks API are unavailable, so the template has no working entry point.Changes
registry/coder-labs/templates/tasks-docker/(README.md,main.tf).registry/coder-labs/.images/tasks-screenshot.png, which only that README used..icons/tasks.svg. The deleted template's frontmatter was the only reference to it in the repo..agents/skills/coder-templates/SKILL.md: drop the Coder Tasks guidance, so the skill stops teaching agents to build templates against a deprecated feature.Tasksdocs link,coder_ai_taskresource andcoder_taskdata source rows in the provider tables,### Task-Oriented Templatessection.Taskcolumn header in the Commands table stays; it is a plain table heading, not Coder Tasks.registry/sharkymark/templates/docker-claude/README.md: remove the link to the deletedmain.tfand the deadcoder.com/docs/ai-coder/taskslink. That template never declaredcoder_ai_task, so Tasks docs were the wrong reference for it regardless.registry/coder/modules/claude-code/README.md: in the v5 upgrade warning, unlink the deleted Tasks docs page, and change "We plan to add those back in a follow-up" to "We plan to add Boundary support back in a follow-up", since Tasks support is not coming back.registry/coder-labs/modules/codex/README.md: unlink the same deleted page.registry/harleylrn/modules/kiro-cli/README.md: unlink the same deleted page and delete the whole### Coder Tasks Integrationsection, which documentedcoder_task,coder_ai_taskandreport_taskswiring.registry/coder-labs/modules/opencode/README.md: drop thecoder_ai_taskresource andai_promptwiring from the basic usage example, and rename it from "Basic Usage with Tasks" to "Basic Usage".Module versions
Four module READMEs changed, so each gets a patch bump via
./.github/scripts/version-bump.sh patch:coder-labs/codexcoder/claude-codecoder-labs/opencodeharleylrn/kiro-cliEffect
The template disappears from registry.coder.com. Anyone who already created a Coder template from it is unaffected; template versions live in their own deployment, not here.
Not in this PR
agentapi,coder-utils,aider,goose,opencode,copilot,auggie,cursor-cli,sourcegraph-amp,kiro-cliandsharkymark/docker-claude:report_tasksinputs,task_app_idoutputs,ai_promptwiring and MCP task reporting. Those are breaking changes that needagentapito go first, so they belong in a sequenced follow-up owned by those module teams.taskstag in module frontmatter, which still drives registry search ongoose,sourcegraph-amp,opencode,auggie,cursor-cli,copilot,kiro-cliandsharkymark/docker-claude. Those modules still ship working Tasks plumbing, so the tag is better dropped in the same release that removes it.kiro-cli's description and outputs still mention task reporting for the same reason.Validation
go build ./cmd/readmevalidation && ./readmevalidation: passes, all relative README URLs still valid.bun x prettier --check .: passes../.github/scripts/version-bump.sh --ci patch origin/main: passes, versions match.Authored by Coder Agents on behalf of @david-fraley.