[Emyrk]

Give Claude Code runners an idle-session release setting, so an inactive session can park and its runner can exit.

• Default: 60 minutes without user input after a turn. Set release_idle_session_min = 0 to never release for idleness.
• The workspace parameter lets Agent Relay choose the duration per pool.

Context

Refs RELAY-56. Companion to agent-relay#122.

The module declares agent_relay_claude_code_release_idle_session_min and passes a positive value to claude self-hosted-runner --release-idle-session-min. A zero value omits the flag. The parameter's default is the module variable, so older relays that don't stamp it still use 60 minutes; set the module variable to 0 to retain the previous never-release behavior. The start script rejects invalid values before starting the runner. additional_args cannot set the flag twice.

This is independent of exit_if_unused_min, which applies only before the runner receives a session. CLI 2.1.310 permits 0 to 10080 minutes. The module version remains at 0.5.0 while that version has not been tagged; re-bump if it is tagged before merging.

Verified: 24 Terraform tests, 24 Bun container tests, rendered shellcheck, formatting, Terraform validation, README validation, and CI. No registered-runner UAT for this setting yet.

---

_{Coder Agents on behalf of @Emyrk.}

[github-actions]

Module Scorecard Check

coder/agent-relay-claude-code: 58 → 58

✅ Score unchanged at 58 / 100. This PR does not affect the module's scorecard; the results are still good.

Theme	Before	After
Presentation & Onboarding	6 / 17	6 / 17
Integration	5 / 25	5 / 25
Credential Hygiene	20 / 20	20 / 20
Restricted-Environment	12 / 20	12 / 20
Engineering Quality	10 / 10	10 / 10
Overall	58 / 100	58 / 100

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	5 / 25	20 / 20	12 / 20	10 / 10	58 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	The main "mode" switch is install_cli (download vs. pre-baked image). The top example shows install_cli = true with an inline comment explaining the false path, but there is no dedicated full example for install_cli = false. Additional sections (additional_args, release_idle_session_min, health_port) each have code examples, but these are tuning knobs rather than distinct operating modes. Partial/under-documented → half.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	agent_relay_credential is ephemeral = true with styling.mask_input = true (verified by main.tftest.hcl's "mask_input":true assertion), and no README example inlines a literal or placeholder key — every relay-stamped field shows only "Set by Agent Relay on dispatch."
Non-hardcoded auth path	4	4	Auth is delegated to Agent Relay stamping an ephemeral masked parameter (agent_relay_credential) rather than pasting a raw API key into the template; this flow is explicitly documented in the "Parameters" section.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	install.sh.tftpl hardcodes curl https://claude.ai/install.sh -fsSL | bash. No module variable (e.g. an install-URL override) exists to redirect this to an internal mirror; cli_binary only overrides the binary path/name, not the download source.
Bring-your-own binary	10	10	install_cli = false fully disables the download and is documented both in the top example ("Bake the CLI into the image and set this to false...") and the "Requirements" section; tests (main.test.ts) confirm the no-op path and the ~/.local/bin fallback.
Egress transparency	3	0	No dedicated README section enumerates install/runtime endpoints (e.g. claude.ai, Anthropic APIs). The install URL only appears in the script file, not in README prose.
Runs without sudo	2	2	Neither install.sh.tftpl nor start.sh.tftpl invokes sudo anywhere; both scripts run entirely as the invoking user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Every variable has a clear description and sensible default; several carry explicit validation blocks (cli_binary regex, exit_if_unused_min, release_idle_session_min range 0–10080, health_port range, additional_args reserved-flag/newline checks).
Test coverage	4	4	main.tftest.hcl has extensive .tftest.hcl runs covering the parameter contract, script rendering, and edge cases; main.test.ts is a thorough container-based TypeScript suite exercising install/start lifecycle, idle release, health endpoint, and injection-safety behavior end-to-end.

Agent Integration — 5 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README; the module integrates with "Agent Relay," a different dispatch mechanism, not AI Gateway/Agent Firewall governance.
Dashboard entry point	5	0	No coder_app resource or mention of one in main.tf or the README.
Session continuity	5	5	"Idle session release" section explicitly documents resuming: "the runner parks the session server-side and exits... The user's next message resumes the session on a fresh runner."
Managed configuration	5	0	base_dir exists as a workdir-controlling variable in main.tf, but it is never mentioned or shown in the README — only in source comments and tests, which does not meet the documentation bar.

Overall — 58 / 100

Raw 53 / 92 → round(53 / 92 × 100) = 58

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.

[linear-code]

RELAY-56