Merge branch 'main' into feat/nodejs-pre-post-install-scripts

- Base64 encode pre/post install scripts to safely handle special characters
- Use separate coder_script resources for pre_install, install, and post_install
- Add coder exp sync want/start/complete for execution ordering
- Base64 encode the main install script (run.sh) via templatefile + base64encode
- Revert run.sh to original (no pre/post install handling)
- Add sync name outputs for cross-module dependency coordination
- Update README with cross-module coordination documentation
- Add output assertions to tests

registry/coder-labs/modules/codex/README.md

@@ -13,7 +13,7 @@ Run Codex CLI in your workspace to access OpenAI's models through the Codex inte
 ```tf
 module "codex" {
   source         = "registry.coder.com/coder-labs/codex/coder"
-  version        = "4.3.0"
+  version        = "4.3.1"
   agent_id       = coder_agent.example.id
   openai_api_key = var.openai_api_key
   workdir        = "/home/coder/project"
@@ -32,7 +32,7 @@ module "codex" {
 module "codex" {
   count          = data.coder_workspace.me.start_count
   source         = "registry.coder.com/coder-labs/codex/coder"
-  version        = "4.3.0"
+  version        = "4.3.1"
   agent_id       = coder_agent.example.id
   openai_api_key = "..."
   workdir        = "/home/coder/project"
@@ -51,7 +51,7 @@ For tasks integration with AI Bridge, add `enable_aibridge = true` to the [Usage
 ```tf
 module "codex" {
   source          = "registry.coder.com/coder-labs/codex/coder"
-  version         = "4.3.0"
+  version         = "4.3.1"
   agent_id        = coder_agent.example.id
   workdir         = "/home/coder/project"
   enable_aibridge = true
@@ -60,21 +60,16 @@ module "codex" {
 
 When `enable_aibridge = true`, the module:
 
-- Configures Codex to use the AI Bridge profile with `base_url` pointing to `${data.coder_workspace.me.access_url}/api/v2/aibridge/openai/v1` and `env_key` pointing to the workspace owner's session token
+- Configures Codex to use the aibridge model_provider with `base_url` pointing to `${data.coder_workspace.me.access_url}/api/v2/aibridge/openai/v1` and `env_key` pointing to the workspace owner's session token
 
 ```toml
-profile = "aibridge" # sets the default profile to aibridge
+model_provider = "aibridge"
 
 [model_providers.aibridge]
 name = "AI Bridge"
 base_url = "https://example.coder.com/api/v2/aibridge/openai/v1"
 env_key = "CODER_AIBRIDGE_SESSION_TOKEN"
 wire_api = "responses"
-
-[profiles.aibridge]
-model_provider = "aibridge"
-model = "<model>" # as configured in the module input
-model_reasoning_effort = "<model_reasoning_effort>" # as configured in the module input
 ```
 
 This allows Codex to route API requests through Coder's AI Bridge instead of directly to OpenAI's API.
@@ -94,7 +89,7 @@ data "coder_task" "me" {}
 
 module "codex" {
   source         = "registry.coder.com/coder-labs/codex/coder"
-  version        = "4.3.0"
+  version        = "4.3.1"
   agent_id       = coder_agent.example.id
   openai_api_key = "..."
   ai_prompt      = data.coder_task.me.prompt
@@ -114,7 +109,7 @@ By default, when `enable_boundary = true`, the module uses `coder boundary` subc
 ```tf
 module "codex" {
   source          = "registry.coder.com/coder-labs/codex/coder"
-  version         = "4.3.0"
+  version         = "4.3.1"
   agent_id        = coder_agent.main.id
   openai_api_key  = var.openai_api_key
   workdir         = "/home/coder/project"
@@ -132,7 +127,7 @@ This example shows additional configuration options for custom models, MCP serve
 ```tf
 module "codex" {
   source         = "registry.coder.com/coder-labs/codex/coder"
-  version        = "4.3.0"
+  version        = "4.3.1"
   agent_id       = coder_agent.example.id
   openai_api_key = "..."
   workdir        = "/home/coder/project"

registry/coder-labs/modules/codex/main.test.ts

@@ -468,10 +468,7 @@ describe("codex", async () => {
       id,
       "/home/coder/.codex/config.toml",
     );
-    expect(configToml).toContain(
-      "[profiles.aibridge]\n" + 'model_provider = "aibridge"',
-    );
-    expect(configToml).toContain('profile = "aibridge"');
+    expect(configToml).toContain('model_provider = "aibridge"');
   });
 
   test("boundary-enabled", async () => {

registry/coder-labs/modules/codex/main.tf

@@ -84,10 +84,10 @@ variable "enable_aibridge" {
 
 variable "model_reasoning_effort" {
   type        = string
-  description = "The reasoning effort for the AI Bridge model. One of: none, low, medium, high. https://platform.openai.com/docs/guides/latest-model#lower-reasoning-effort"
-  default     = "medium"
+  description = "The reasoning effort for the model. One of: none, low, medium, high. https://platform.openai.com/docs/guides/latest-model#lower-reasoning-effort"
+  default     = ""
   validation {
-    condition     = contains(["none", "low", "medium", "high"], var.model_reasoning_effort)
+    condition     = contains(["", "none", "minimal", "low", "medium", "high", "xhigh"], var.model_reasoning_effort)
     error_message = "model_reasoning_effort must be one of: none, low, medium, high."
   }
 }
@@ -137,7 +137,7 @@ variable "agentapi_version" {
 variable "codex_model" {
   type        = string
   description = "The model for Codex to use. Defaults to gpt-5.3-codex."
-  default     = "gpt-5.3-codex"
+  default     = "gpt-5.4"
 }
 
 variable "pre_install_script" {
@@ -225,7 +225,7 @@ locals {
   install_script     = file("${path.module}/scripts/install.sh")
   start_script       = file("${path.module}/scripts/start.sh")
   module_dir_name    = ".codex-module"
-  latest_codex_model = "gpt-5.3-codex"
+  latest_codex_model = "gpt-5.4"
   aibridge_config    = <<-EOF
   [model_providers.aibridge]
   name = "AI Bridge"
@@ -233,10 +233,6 @@ locals {
   env_key = "CODER_AIBRIDGE_SESSION_TOKEN"
   wire_api = "responses"
 
-  [profiles.aibridge]
-  model_provider = "aibridge"
-  model = "${var.codex_model}"
-  model_reasoning_effort = "${var.model_reasoning_effort}"
   EOF
 }
 
@@ -302,6 +298,7 @@ module "agentapi" {
     ARG_ADDITIONAL_MCP_SERVERS='${base64encode(var.additional_mcp_servers)}' \
     ARG_CODER_MCP_APP_STATUS_SLUG='${local.app_slug}' \
     ARG_CODEX_START_DIRECTORY='${local.workdir}' \
+    ARG_MODEL_REASONING_EFFORT='${var.model_reasoning_effort}' \
     ARG_CODEX_INSTRUCTION_PROMPT='${base64encode(var.codex_system_prompt)}' \
     /tmp/install.sh
   EOT

registry/coder-labs/modules/codex/scripts/install.sh

@@ -93,10 +93,14 @@ function install_codex() {
 write_minimal_default_config() {
   local config_path="$1"
 
-  ARG_DEFAULT_PROFILE=""
+  ARG_OPTIONAL_TOP_LEVEL_CONFIG=""
 
   if [[ "${ARG_ENABLE_AIBRIDGE}" = "true" ]]; then
-    ARG_DEFAULT_PROFILE='profile = "aibridge"'
+    ARG_OPTIONAL_TOP_LEVEL_CONFIG='model_provider = "aibridge"'
+  fi
+
+  if [[ "${ARG_MODEL_REASONING_EFFORT}" != "" ]]; then
+    ARG_OPTIONAL_TOP_LEVEL_CONFIG+=$'\n'"model_reasoning_effort = \"${ARG_MODEL_REASONING_EFFORT}\""
   fi
 
   cat << EOF > "$config_path"
@@ -104,13 +108,17 @@ write_minimal_default_config() {
 sandbox_mode = "workspace-write"
 approval_policy = "never"
 preferred_auth_method = "apikey"
-${ARG_DEFAULT_PROFILE}
+${ARG_OPTIONAL_TOP_LEVEL_CONFIG}
 
 [sandbox_workspace_write]
 network_access = true
 
 [notice.model_migrations]
 "${ARG_CODEX_MODEL}" = "${ARG_LATEST_CODEX_MODEL}"
+
+[projects."${ARG_CODEX_START_DIRECTORY}"]
+trust_level = "trusted"
+
 EOF
 }
 

registry/coder-labs/modules/codex/scripts/start.sh

@@ -155,7 +155,7 @@ setup_workdir() {
 build_codex_args() {
   CODEX_ARGS=()
 
-  if [[ -n "${ARG_CODEX_MODEL}" ]] && [[ "${ARG_ENABLE_AIBRIDGE}" != "true" ]]; then
+  if [[ -n "${ARG_CODEX_MODEL}" ]]; then
     CODEX_ARGS+=("--model" "${ARG_CODEX_MODEL}")
   fi
 

registry/thezoker/modules/nodejs/README.md

@@ -15,7 +15,7 @@ Automatically installs [Node.js](https://github.com/nodejs/node) via [`nvm`](htt
 module "nodejs" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/thezoker/nodejs/coder"
-  version  = "1.0.13"
+  version  = "1.1.0"
   agent_id = coder_agent.example.id
 }
 ```
@@ -28,17 +28,55 @@ This installs multiple versions of Node.js:
 module "nodejs" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/thezoker/nodejs/coder"
-  version  = "1.0.13"
+  version  = "1.1.0"
   agent_id = coder_agent.example.id
   node_versions = [
     "18",
     "20",
     "node"
   ]
-  default_node_version = "1.0.13"
+  default_node_version = "20"
 }
 ```
 
+## Pre and Post Install Scripts
+
+Use `pre_install_script` and `post_install_script` to run custom scripts before and after Node.js installation.
+
+```tf
+module "nodejs" {
+  count    = data.coder_workspace.me.start_count
+  source   = "registry.coder.com/thezoker/nodejs/coder"
+  version  = "1.1.0"
+  agent_id = coder_agent.example.id
+
+  pre_install_script  = "echo 'Setting up prerequisites...'"
+  post_install_script = "npm install -g yarn pnpm"
+}
+```
+
+## Cross-Module Dependency Ordering
+
+This module uses `coder exp sync` to coordinate execution ordering with other modules. It exposes the following outputs for use with `coder exp sync want`:
+
+- `install_script_name` — the sync name for the main Node.js installation script
+- `pre_install_script_name` — the sync name for the pre-install script
+- `post_install_script_name` — the sync name for the post-install script
+
+For example, to ensure another module waits for Node.js to be fully installed:
+
+```tf
+module "nodejs" {
+  count    = data.coder_workspace.me.start_count
+  source   = "registry.coder.com/thezoker/nodejs/coder"
+  version  = "1.1.0"
+  agent_id = coder_agent.example.id
+}
+
+# In another module's coder_script, wait for Node.js installation:
+# coder exp sync want my-script ${module.nodejs[0].install_script_name}
+```
+
 ## Full example
 
 A example with all available options:
@@ -47,15 +85,17 @@ A example with all available options:
 module "nodejs" {
   count              = data.coder_workspace.me.start_count
   source             = "registry.coder.com/thezoker/nodejs/coder"
-  version            = "1.0.13"
+  version            = "1.1.0"
   agent_id           = coder_agent.example.id
-  nvm_version        = "1.0.13"
+  nvm_version        = "v0.39.7"
   nvm_install_prefix = "/opt/nvm"
   node_versions = [
-    "16",
     "18",
+    "20",
     "node"
   ]
-  default_node_version = "1.0.13"
+  default_node_version = "20"
+  pre_install_script   = "echo 'Pre-install setup'"
+  post_install_script  = "npm install -g typescript"
 }
 ```

registry/thezoker/modules/nodejs/main.tf

@@ -38,15 +38,125 @@ variable "default_node_version" {
   default     = "node"
 }
 
-resource "coder_script" "nodejs" {
-  agent_id     = var.agent_id
-  display_name = "Node.js:"
-  script = templatefile("${path.module}/run.sh", {
-    NVM_VERSION : var.nvm_version,
-    INSTALL_PREFIX : var.nvm_install_prefix,
-    NODE_VERSIONS : join(",", var.node_versions),
-    DEFAULT : var.default_node_version,
+variable "pre_install_script" {
+  type        = string
+  description = "Custom script to run before installing Node.js."
+  default     = null
+}
+
+variable "post_install_script" {
+  type        = string
+  description = "Custom script to run after installing Node.js."
+  default     = null
+}
+
+locals {
+  encoded_pre_install_script  = var.pre_install_script != null ? base64encode(var.pre_install_script) : ""
+  encoded_post_install_script = var.post_install_script != null ? base64encode(var.post_install_script) : ""
+
+  install_script = templatefile("${path.module}/run.sh", {
+    NVM_VERSION    = var.nvm_version,
+    INSTALL_PREFIX = var.nvm_install_prefix,
+    NODE_VERSIONS  = join(",", var.node_versions),
+    DEFAULT        = var.default_node_version,
   })
+  encoded_install_script = base64encode(local.install_script)
+
+  pre_install_script_name  = "nodejs-pre_install_script"
+  install_script_name      = "nodejs-install_script"
+  post_install_script_name = "nodejs-post_install_script"
+
+  module_dir_path = "$HOME/.nodejs-module"
+
+  pre_install_path      = "${local.module_dir_path}/pre_install.sh"
+  pre_install_log_path  = "${local.module_dir_path}/pre_install.log"
+  install_path          = "${local.module_dir_path}/install.sh"
+  install_log_path      = "${local.module_dir_path}/install.log"
+  post_install_path     = "${local.module_dir_path}/post_install.sh"
+  post_install_log_path = "${local.module_dir_path}/post_install.log"
+}
+
+resource "coder_script" "pre_install_script" {
+  count        = var.pre_install_script == null ? 0 : 1
+  agent_id     = var.agent_id
+  display_name = "Node.js: Pre-Install"
+  run_on_start = true
+  script       = <<-EOT
+    #!/bin/bash
+    set -o errexit
+    set -o pipefail
+
+    mkdir -p ${local.module_dir_path}
+
+    trap 'coder exp sync complete ${local.pre_install_script_name}' EXIT
+    coder exp sync start ${local.pre_install_script_name}
+
+    echo -n '${local.encoded_pre_install_script}' | base64 -d > ${local.pre_install_path}
+    chmod +x ${local.pre_install_path}
+
+    ${local.pre_install_path} 2>&1 | tee ${local.pre_install_log_path}
+  EOT
+}
+
+resource "coder_script" "nodejs" {
+  agent_id           = var.agent_id
+  display_name       = "Node.js: Install"
+  script             = <<-EOT
+    #!/bin/bash
+    set -o errexit
+    set -o pipefail
+
+    mkdir -p ${local.module_dir_path}
+
+    trap 'coder exp sync complete ${local.install_script_name}' EXIT
+    %{if var.pre_install_script != null~}
+    coder exp sync want ${local.install_script_name} ${local.pre_install_script_name}
+    %{endif~}
+    coder exp sync start ${local.install_script_name}
+
+    echo -n '${local.encoded_install_script}' | base64 -d > ${local.install_path}
+    chmod +x ${local.install_path}
+
+    ${local.install_path} 2>&1 | tee ${local.install_log_path}
+  EOT
   run_on_start       = true
   start_blocks_login = true
 }
+
+resource "coder_script" "post_install_script" {
+  count        = var.post_install_script != null ? 1 : 0
+  agent_id     = var.agent_id
+  display_name = "Node.js: Post-Install"
+  run_on_start = true
+  script       = <<-EOT
+    #!/bin/bash
+    set -o errexit
+    set -o pipefail
+
+    mkdir -p ${local.module_dir_path}
+
+    trap 'coder exp sync complete ${local.post_install_script_name}' EXIT
+    coder exp sync want ${local.post_install_script_name} ${local.install_script_name}
+    coder exp sync start ${local.post_install_script_name}
+
+    echo -n '${local.encoded_post_install_script}' | base64 -d > ${local.post_install_path}
+    chmod +x ${local.post_install_path}
+
+    ${local.post_install_path} 2>&1 | tee ${local.post_install_log_path}
+  EOT
+}
+
+output "pre_install_script_name" {
+  description = "The name of the pre-install script for coder exp sync coordination."
+  value       = local.pre_install_script_name
+}
+
+output "install_script_name" {
+  description = "The name of the install script for coder exp sync coordination."
+  value       = local.install_script_name
+}
+
+output "post_install_script_name" {
+  description = "The name of the post-install script for coder exp sync coordination."
+  value       = local.post_install_script_name
+}

registry/thezoker/modules/nodejs/nodejs.tftest.hcl

@@ -0,0 +1,137 @@
+run "test_nodejs_basic" {
+  command = plan
+
+  variables {
+    agent_id = "test-agent-123"
+  }
+
+  assert {
+    condition     = var.agent_id == "test-agent-123"
+    error_message = "Agent ID variable should be set correctly"
+  }
+
+  assert {
+    condition     = var.nvm_version == "master"
+    error_message = "nvm_version should default to master"
+  }
+
+  assert {
+    condition     = var.default_node_version == "node"
+    error_message = "default_node_version should default to node"
+  }
+
+  assert {
+    condition     = var.pre_install_script == null
+    error_message = "pre_install_script should default to null"
+  }
+
+  assert {
+    condition     = var.post_install_script == null
+    error_message = "post_install_script should default to null"
+  }
+
+  assert {
+    condition     = output.install_script_name == "nodejs-install_script"
+    error_message = "install_script_name output should be set"
+  }
+}
+
+run "test_with_scripts" {
+  command = plan
+
+  variables {
+    agent_id            = "test-agent-scripts"
+    pre_install_script  = "echo 'Pre-install script'"
+    post_install_script = "echo 'Post-install script'"
+  }
+
+  assert {
+    condition     = var.pre_install_script == "echo 'Pre-install script'"
+    error_message = "Pre-install script should be set correctly"
+  }
+
+  assert {
+    condition     = var.post_install_script == "echo 'Post-install script'"
+    error_message = "Post-install script should be set correctly"
+  }
+
+  assert {
+    condition     = output.pre_install_script_name == "nodejs-pre_install_script"
+    error_message = "pre_install_script_name output should be set"
+  }
+
+  assert {
+    condition     = output.post_install_script_name == "nodejs-post_install_script"
+    error_message = "post_install_script_name output should be set"
+  }
+}
+
+run "test_custom_options" {
+  command = plan
+
+  variables {
+    agent_id             = "test-agent-custom"
+    nvm_version          = "v0.39.7"
+    nvm_install_prefix   = ".custom-nvm"
+    node_versions        = ["18", "20", "node"]
+    default_node_version = "20"
+  }
+
+  assert {
+    condition     = var.nvm_version == "v0.39.7"
+    error_message = "nvm_version should be set to v0.39.7"
+  }
+
+  assert {
+    condition     = var.nvm_install_prefix == ".custom-nvm"
+    error_message = "nvm_install_prefix should be set correctly"
+  }
+
+  assert {
+    condition     = length(var.node_versions) == 3
+    error_message = "node_versions should have 3 entries"
+  }
+
+  assert {
+    condition     = var.default_node_version == "20"
+    error_message = "default_node_version should be set to 20"
+  }
+}
+
+run "test_with_pre_install_only" {
+  command = plan
+
+  variables {
+    agent_id           = "test-agent-pre"
+    pre_install_script = "echo 'pre-install'"
+  }
+
+  assert {
+    condition     = var.pre_install_script != null
+    error_message = "Pre-install script should be set"
+  }
+
+  assert {
+    condition     = var.post_install_script == null
+    error_message = "Post-install script should default to null"
+  }
+}
+
+run "test_with_post_install_only" {
+  command = plan
+
+  variables {
+    agent_id            = "test-agent-post"
+    post_install_script = "echo 'post-install'"
+  }
+
+  assert {
+    condition     = var.pre_install_script == null
+    error_message = "Pre-install script should default to null"
+  }
+
+  assert {
+    condition     = var.post_install_script != null
+    error_message = "Post-install script should be set"
+  }
+}