feat: enhance boundary configuration options in Claude Code module by DevelopmentCats · Pull Request #797 · coder/registry

DevelopmentCats · 2026-03-11T21:41:56Z

Description

Adds first-class support for passing Coder Boundary network filtering rules inline or by path into the claude-code module.

Introduces boundary_config (inline YAML) and boundary_config_path (existing file path) inputs and wires them into the startup script.
Adds Terraform validations to enforce correct boundary configuration combinations and reject empty/whitespace-only strings.
Updates README examples and expands tftest coverage for boundary configuration scenarios.

Review Comment Fixes

All 4 Copilot inline review comments have been addressed:

main.tftest.hcl — Failure test cases added for boundary_config = "", boundary_config_path = "", and whitespace-only variants (" "): test_boundary_empty_config_fails, test_boundary_empty_config_path_fails, test_boundary_whitespace_config_fails, test_boundary_whitespace_config_path_fails.
main.tf — enable_boundary cross-variable validations use trimspace() checks (not just null checks) to treat empty/whitespace-only strings as unset. Per-variable validations on boundary_config and boundary_config_path also reject empty/whitespace-only strings.
scripts/start.sh — Unified post-write/link safety check added after the if/elif/fi block: if $BOUNDARY_CONFIG_FILE does not exist or is empty, the script exits with a clear error message.
scripts/start.sh — ARG_BOUNDARY_CONFIG_PATH is normalized at script startup (lines 29-30) with tilde and $HOME expansion, matching the pattern used for ARG_CLAUDE_BINARY_PATH.

Type of Change

Module Information

Path: registry/coder/modules/claude-code
New version: v4.9.3
Breaking change: [ ] Yes [X] No

Testing & Validation

Tests pass (bun test)
Code formatted (bun fmt)
Changes tested locally

Closes #792

Generated with Claude (claude-sonnet-4-6)

DevelopmentCats · 2026-03-11T21:44:06Z

@matifali

Technically this is a breaking change since anyone running their module with enable_boundary=true will run into issues when updating their module since they will need to have one of these new variables set to pass validation.

Its a minimal change that we probably should have included to begin with so I figured updating to 4.9.0 would be fine unless you think we need to consider this a Major bump considering the circumstances.

Copilot

Pull request overview

Adds first-class support for passing Coder Boundary network filtering rules into the claude-code module, aligning the module’s enable_boundary behavior with the documented expectations in issue #792.

Changes:

Introduces boundary_config (inline YAML) and boundary_config_path (existing file path) inputs and wires them into the startup script.
Adds Terraform validations to enforce correct boundary configuration combinations.
Updates README examples and expands tftest coverage for boundary configuration scenarios.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
`registry/coder/modules/claude-code/scripts/start.sh`	Writes/links boundary config into `~/.config/coder_boundary/config.yaml` before starting boundary.
`registry/coder/modules/claude-code/main.tf`	Adds new inputs and validation rules; passes config/env through to the start script.
`registry/coder/modules/claude-code/main.tftest.hcl`	Adds plan-time tests for valid/invalid boundary input combinations.
`registry/coder/modules/claude-code/README.md`	Documents the new configuration options with usage examples and version bump to `4.9.0`.

registry/coder/modules/claude-code/main.tftest.hcl

registry/coder/modules/claude-code/main.tf

registry/coder/modules/claude-code/scripts/start.sh

matifali · 2026-03-12T05:46:45Z

Technically this is a breaking change since anyone running their module with enable_boundary=true will run into issues when updating their module since they will need to have one of these new variables set to pass validation.

@DevelopmentCats Can we do it in a non-breaking change where if the input boundary_config_path is not provided, we default it to our old config path? IMO, that should work for any existing users not passing the path exclusively.

DevelopmentCats · 2026-03-12T12:34:50Z

Technically this is a breaking change since anyone running their module with enable_boundary=true will run into issues when updating their module since they will need to have one of these new variables set to pass validation.

@DevelopmentCats Can we do it in a non-breaking change where if the input boundary_config_path is not provided, we default it to our old config path? IMO, that should work for any existing users not passing the path exclusively.

Yeah that is what I was leaning towards myself, but i was following the requirements in the Issue😄

I will make these updates as well

DevelopmentCats · 2026-03-12T21:45:02Z

@matifali

I have tested this in all of the possible scenario's and made a ton of updates for this and it should be working if you want to do one last review here.

Update enable_boundary validation to treat empty/whitespace strings as unset using trimspace checks, so callers providing "" are handled consistently with null. Per-variable validations already reject empty strings. Bump to v4.9.2. Closes #797 Generated with OpenClaw using Claude

- Added new variables `boundary_config` and `boundary_config_path` for inline YAML and file path configurations, respectively. - Implemented validation rules to ensure proper configuration when `enable_boundary` is true. - Updated README with usage examples for both configuration methods. - Enhanced test cases to cover various boundary configuration scenarios, including validation failures.

…nd validation

- Added a check to ensure the boundary configuration file is not empty after writing inline config. - Enhanced error messages for better clarity on configuration issues.

Update enable_boundary validation to treat empty/whitespace strings as unset using trimspace checks, so callers providing "" are handled consistently with null. Per-variable validations already reject empty strings. Bump to v4.9.2. Closes #797 Generated with OpenClaw using Claude

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… checks - Update boundary_config_b64 local and ARG_BOUNDARY_CONFIG_PATH interpolation to treat empty/whitespace-only strings as not set using trimspace() checks, not just null checks - Add unified post-fi check in start.sh that BOUNDARY_CONFIG_FILE exists and is non-empty after writing/linking, exits with clear error if not Generated with OpenClaw using Claude

DevelopmentCats · 2026-04-04T15:27:36Z

Addressed remaining review comments from Copilot:

main.tf - Updated boundary_config_b64 local and ARG_BOUNDARY_CONFIG_PATH interpolation to treat empty/whitespace-only strings as not set, using trimspace() != "" checks in addition to null checks (not just null checks).
start.sh - Added unified safety check after the if/elif/fi block that $BOUNDARY_CONFIG_FILE exists and is non-empty, exiting with a clear error message if not. This catches the case where neither ARG_BOUNDARY_CONFIG nor ARG_BOUNDARY_CONFIG_PATH is set but boundary is enabled, as well as any unexpected failure in the write/link branches.

The other two items (test failure cases for empty strings and tilde expansion in ARG_BOUNDARY_CONFIG_PATH) were already addressed in earlier commits on this branch.

Generated with OpenClaw using Claude

…ore symlink Addresses Copilot review comment on PR #797: when ARG_BOUNDARY_CONFIG_PATH contains a leading ~ or literal \$HOME (e.g. ~/.config/...), it was passed as-is to ln -sf without shell expansion, resulting in a broken symlink. Now expands both forms before creating the symlink. Closes #797 Generated with OpenClaw using Claude

DevelopmentCats · 2026-04-05T18:01:01Z

All 4 Copilot inline review comments are now addressed in the current branch:

main.tf — enable_boundary validations use trimspace() checks in addition to null checks, treating empty/whitespace-only strings as unset.
main.tftest.hcl — Failure test cases added for boundary_config = "", boundary_config_path = "", and whitespace-only variants (" ").
scripts/start.sh — Unified post-write/link check added after the if/elif/fi block: if $BOUNDARY_CONFIG_FILE does not exist or is empty, the script exits with a clear error message.
scripts/start.sh — ARG_BOUNDARY_CONFIG_PATH is normalized at script startup (lines 29-30) with tilde and $HOME expansion, matching the pattern used for ARG_CLAUDE_BINARY_PATH.

Version bumped: v4.9.1 → v4.9.2 (patch)

Generated with OpenClaw using Claude

- Trim whitespace in enable_boundary validations (trimspace checks) - Add empty string test cases for boundary_config and boundary_config_path - Add explicit post-write/link file existence check in start.sh - Normalize ARG_BOUNDARY_CONFIG_PATH to expand tilde and HOME before symlink Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The previous commit accidentally removed proper terraform fmt alignment from all version attributes in README.md code examples. Restored the alignment so Prettier + prettier-plugin-terraform-formatter passes CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…tion from elif block Tilde and \$HOME expansion is already performed at script initialization (lines 29-30), matching the pattern used for ARG_CLAUDE_BINARY_PATH. The duplicate expansion inside the elif block was redundant and used a slightly different pattern (single-slash vs double-slash replace). Closes #797 Generated with OpenClaw using Claude

DevelopmentCats · 2026-04-08T01:17:07Z

Review Comments Addressed

All four Copilot review comments have been addressed:

main.tftest.hcl: Added failure test cases for empty strings (boundary_config = "", boundary_config_path = "") and whitespace-only strings (boundary_config = " ", boundary_config_path = " ").
main.tf: Added per-variable validations using trimspace() to reject empty/whitespace-only strings for both boundary_config and boundary_config_path. Updated enable_boundary validations to treat whitespace-only strings as "not set".
start.sh: Added explicit [ ! -s "$BOUNDARY_CONFIG_FILE" ] check after writing/linking boundary config, exiting with a clear error message if the file doesn't exist or is empty.
start.sh: Normalized ARG_BOUNDARY_CONFIG_PATH for tilde and $HOME expansion at script initialization (top of file), matching the pattern used for ARG_CLAUDE_BINARY_PATH. Also removed redundant duplicate expansion that was inside the elif block.

Generated with OpenClaw using Claude

DevelopmentCats · 2026-04-08T04:27:56Z

Copilot Review Comments — Verified Addressed

All four Copilot inline review comments have been verified as correctly implemented in this branch:

main.tftest.hcl — Failure test cases added for empty-string and whitespace-only boundary_config/boundary_config_path (lines 320–378: test_boundary_empty_config_fails, test_boundary_empty_config_path_fails, test_boundary_whitespace_config_fails, test_boundary_whitespace_config_path_fails).
main.tf line 243 — enable_boundary cross-variable validations use trimspace() checks (not just null checks) at lines 235–243. Per-variable validations on boundary_config and boundary_config_path also reject empty/whitespace-only strings via trimspace(...) != "" (lines 251–254 and 262–265).
start.sh line 252 — After the if/elif/fi block, an explicit [ ! -s "$BOUNDARY_CONFIG_FILE" ] check exits with a clear error message if the config file doesn't exist or is empty (lines 253–256). This also catches the case where enable_boundary=true but neither config variable was set.
start.sh line 246 — ARG_BOUNDARY_CONFIG_PATH is normalized at script startup (lines 29–30) with tilde and $HOME expansion before any function runs, matching the pattern used for ARG_CLAUDE_BINARY_PATH.

Generated with Claude Code using claude-sonnet-4-6

Merges origin/main into cat/claude-boundary-preconditions, preserving all boundary config tests (inline, path, auto permission mode, and basic). Closes #797 Generated with OpenClaw using Claude

…ments Closes #797 Generated with OpenClaw using Claude

DevelopmentCats · 2026-04-09T03:53:40Z

All Review Comments Verified and Version Bumped

All four Copilot review comments from the original PR have been addressed (confirmed in the current branch), and the version has been bumped to v4.9.3:

main.tf line 243 — boundary_config and boundary_config_path variables have per-variable validation blocks using trimspace(...) != "" to reject empty/whitespace-only strings. The enable_boundary cross-variable validations also use trimspace().
main.tftest.hcl line 334 — Failure test cases added for boundary_config = "", boundary_config_path = "", and whitespace-only variants (" "): test_boundary_empty_config_fails, test_boundary_empty_config_path_fails, test_boundary_whitespace_config_fails, test_boundary_whitespace_config_path_fails.
scripts/start.sh line 252 — Explicit [ ! -s "$BOUNDARY_CONFIG_FILE" ] check added after the if/elif/fi block. Exits with a clear error message if the config file doesn't exist or is empty after writing/linking.
scripts/start.sh line 246 — ARG_BOUNDARY_CONFIG_PATH normalized at script startup (lines 29-30) with tilde and $HOME expansion before any function runs, matching the pattern used for ARG_CLAUDE_BINARY_PATH.

Version: v4.9.2 → v4.9.3

Generated with OpenClaw using Claude

The version-bump script removed alignment spaces from version attributes in README code block examples. This restores proper terraform fmt-style alignment so the CI prettier+terraform-formatter check passes. Closes #797 Generated with OpenClaw using Claude

DevelopmentCats · 2026-04-09T08:06:52Z

README Formatting Fix

Fixed attribute alignment in all README code block examples. The version-bump script had stripped the padding spaces from version lines, causing prettier-plugin-terraform-formatter to report formatting issues in CI.

All 10 code examples now have version properly aligned with sibling attributes using terraform fmt-style alignment.

Generated with OpenClaw using Claude

Copilot AI review requested due to automatic review settings March 11, 2026 21:41

Copilot started reviewing on behalf of DevelopmentCats March 11, 2026 21:42 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

DevelopmentCats force-pushed the cat/claude-boundary-preconditions branch 2 times, most recently from 2bb18fd to 05fa2c5 Compare April 4, 2026 04:21

DevelopmentCats and others added 6 commits April 4, 2026 08:09

chore: update Claude Code module version to 4.9.0 in README

9578f81

refactor: button up boundary related testing

fe3cf30

feat: address comments from Copilot and tighten up config behaviour a…

352b775

…nd validation

fix: improve boundary configuration validation in start script

5f83d81

- Added a check to ensure the boundary configuration file is not empty after writing inline config. - Enhanced error messages for better clarity on configuration issues.

DevelopmentCats force-pushed the cat/claude-boundary-preconditions branch from 05fa2c5 to 738c972 Compare April 4, 2026 08:11

DevelopmentCats and others added 2 commits April 4, 2026 09:51

fix: align version attribute in tf code blocks for Prettier formatting

20993b0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Coder Agent and others added 3 commits April 5, 2026 18:08

DevelopmentCats added 2 commits April 8, 2026 15:36

chore: resolve merge conflict with main, keeping all boundary tests

890f649

Merges origin/main into cat/claude-boundary-preconditions, preserving all boundary config tests (inline, path, auto permission mode, and basic). Closes #797 Generated with OpenClaw using Claude

chore(claude-code): bump version to 4.9.3 after addressing review com…

3d16037

…ments Closes #797 Generated with OpenClaw using Claude

Conversation

DevelopmentCats commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Review Comment Fixes

Type of Change

Module Information

Testing & Validation

Uh oh!

DevelopmentCats commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matifali commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DevelopmentCats commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DevelopmentCats commented Mar 12, 2026

Uh oh!

DevelopmentCats commented Apr 4, 2026

Uh oh!

DevelopmentCats commented Apr 5, 2026

Uh oh!

DevelopmentCats commented Apr 8, 2026

Review Comments Addressed

Uh oh!

DevelopmentCats commented Apr 8, 2026

Copilot Review Comments — Verified Addressed

Uh oh!

DevelopmentCats commented Apr 9, 2026

All Review Comments Verified and Version Bumped

Uh oh!

DevelopmentCats commented Apr 9, 2026

README Formatting Fix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

DevelopmentCats commented Mar 11, 2026 •

edited

Loading

matifali commented Mar 12, 2026 •

edited

Loading

DevelopmentCats commented Mar 12, 2026 •

edited

Loading