[Emyrk]

Refs RELAY-56.

Makes the runner's health port configurable and adds a metadata script that reports whether the runner is running and holds a session.

• New health_port variable, default 3286 (not the CLI's common 8080), passed as --health-port; 0 disables the listener.
• New session_attached_metadata_script output reads active_sessions from /healthz and prints one state from the table below.
• New health_url output exposes the loopback URL for template scripts.
• --health-port joins the reserved additional_args flags.

agent_relay_session_attached	runner running	session held	when
attached	yes	yes	active_sessions > 0, including between turns
unattached	yes	no	active_sessions = 0: waiting for its first session, or released and still alive
stopped	no	no	state is done, failed, idle, or missing, or the recorded pid is dead or no longer the CLI
disabled	not checked	not checked	health_port = 0
error (non-zero exit)	yes	unknown	/healthz unreachable or has no numeric active_sessions

Running means the supervisor recorded working <pid>, kill -0 <pid> succeeds, and /proc/<pid>/cmdline still names the CLI. The supervisor replaces that line with done <code> when the runner exits.

Agent context

• agent_relay_status stays separate: it reports runner lifecycle for reaping, while this key reports live attachment for keep-alive.
• The CLI (2.1.310) has only --health-port, with no bind-host option, so the address cannot be fully configured. The README warns not to publish the port.
• 3284 was avoided because it is AgentAPI's default across the registry.
• Companion to agent-relay#117, which should renew autostop only on a fresh attached sample. Its README still names 3284/3285 and true.
• Verified: terraform test 17/17, bun test 17/17, shellcheck clean on the rendered script. The attachment tests use a stubbed curl that serves a real 2.1.310 /healthz body. They were not run against a registered runner.

---

_{Coder Agents on behalf of @Emyrk.}

[linear-code]

RELAY-56

[github-actions]

Module Scorecard Check

coder/agent-relay-claude-code: 52 → 64

✅ Score improvement: 52 → 64 (+12).

Theme	Before	After
Presentation & Onboarding	6 / 17	12 / 17
Integration	0 / 25	5 / 25
Credential Hygiene	20 / 20	20 / 20
Restricted-Environment	12 / 20	12 / 20
Engineering Quality	10 / 10	10 / 10
Overall	52 / 100	64 / 100

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	5 / 25	20 / 20	12 / 20	10 / 10	64 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README shows the default (install_cli=true) example, a full additional_args example, and a full health_port override example; install_cli=false/BYO-image mode is clearly explained in the Requirements section and inline comments. Major modes are each covered with sensible defaults shown.
Visual preview	5	0	No image, GIF, or video anywhere in the README; only an icon reference in frontmatter.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	agent_relay_credential is ephemeral = true with mask_input: true styling and rendered disabled; no README example inlines a raw key — credentials are entirely relay-stamped, never typed by a user.
Non-hardcoded auth path	4	4	README documents that auth flows entirely through Agent Relay's work-order JWT (agent_relay_credential), stamped automatically — no manual key-pasting path exists or is shown.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	install.sh.tftpl hardcodes curl https://claude.ai/install.sh -fsSL | bash; no module variable overrides this download URL (cli_binary only overrides the binary path/name, not the install source).
Bring-your-own binary	10	10	install_cli = false fully disables the install step (documented in the first example's inline comment and the Requirements section) and the start script finds a pre-baked CLI via PATH/~/.local/bin.
Egress transparency	3	0	No dedicated README section enumerates endpoints; the claude.ai/install.sh URL and Anthropic API usage appear only in script comments, not in the README at all.
Runs without sudo	2	2	install.sh.tftpl and start.sh.tftpl never invoke sudo; both run as the agent user (tests run as root but nothing requires elevation).

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions and defaults; cli_binary, exit_if_unused_min, health_port, and additional_args all carry meaningful validation blocks.
Test coverage	4	4	main.tftest.hcl thoroughly covers parameter contract and rendering logic; main.test.ts exercises real container lifecycle (install/start, state transitions, wrapper, health probe) end-to-end.

Agent Integration — 5 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README; auth/routing is handled solely by Agent Relay's own dispatch/JWT mechanism, which is a different product.
Dashboard entry point	5	0	No coder_app is declared or documented; README explicitly warns against exposing health_port via coder_app or any network surface.
Session continuity	5	2.5	README documents that the runner process "holds a session, including between turns" and tracks it via agent_relay_session_id/active_sessions, but this is framed as internal reaping bookkeeping rather than a documented user-facing resume/reconnect flow — under-documented for this criterion.
Managed configuration	5	2.5	additional_args lets operators pass arbitrary extra CLI flags to the runner (documented with a full example), but workdir (base_dir) and other settings are documented only in Terraform variable descriptions, not the README itself.

Overall — 64 / 100

Raw 59 / 92 → round(59 / 92 × 100) = 64

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.