VS Code Desktop module

[bpmct]

A discussion dedicated to the VS Code Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	13 / 19	20 / 20	13.5 / 20	10 / 10	80 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents three major modes: default (basic), folder (open in a specific directory), and extensions (pre-install extensions). Each has a complete module block with sensible defaults. Minor parameters (open_recent, order, group) lack examples but are not "major modes."
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field references an SVG file but is not an in-README visual preview.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No variables in this module carry secrets (no API keys, tokens, or credentials). All inputs are structural (agent_id, folder, open_recent, order, group, extensions). README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Auth is handled via Coder's $SESSION_TOKEN mechanism embedded in the vscode:// URI (verified in test output: token=$SESSION_TOKEN). No raw keys are pasted into templates.

Restricted-Environment Readiness — 13.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	Download URLs are hardcoded in scripts/install-remote-server.sh.tftpl (https://update.code.visualstudio.com/api/latest/... and https://update.code.visualstudio.com/commit:...). No module input variable overrides these URLs. SERVER_DIRECTORY_B64 controls install location, not source.
Bring-your-own binary	10	10	The install script begins with if [ -x "$IDE_CLI_PATH" ]; then exit 0; fi, skipping the entire download when the CLI is already present. README documents: "Later workspace starts reuse the existing VS Code Server CLI and do not force extension updates." A user can bake the server into an image at $HOME/.coder-modules/coder/vscode-desktop/server/bin/code-server.
Egress transparency	3	1.5	The extensions section states "The workspace also needs HTTPS egress to the VS Code update and artifact hosts." This is a scattered mention within an example, not a dedicated network/offline section, and does not enumerate the specific domains (update.code.visualstudio.com). Earns half per rubric.
Runs without sudo	2	2	install-remote-server.sh.tftpl never invokes sudo. All operations (mktemp, mkdir, tar, mv, rm) target $HOME/.coder-modules/... and /tmp. No root required.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All six variables have clear description fields and sensible defaults ("", false, null, []). extensions includes a validation block rejecting empty IDs. agent_id is correctly required with no default.
Test coverage	4	4	main.tftest.hcl covers business logic (URL construction, extension validation, empty-ID rejection). main.test.ts provides end-to-end coverage: Terraform apply assertions on URL output, coder_app resource existence, bootstrap script content verification, and a live container test confirming skip-download when CLI is executable.

IDE Integration — 13 / 19

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates a coder_app resource (verified in tests: res.type === "coder_app", res.name === "vscode-desktop"). README states "Add a button to open any workspace with a single click." Uses vscode protocol for proper launch behavior.
Managed configuration	6	0	No documented support for managed IDE settings (settings.json, keybindings, policies). config_dir is passed to the core module but the wrapper exposes no input to inject or manage VS Code configuration files.
Configurable folder or workdir	6	6	folder variable with description "The folder to open in VS Code." README includes a dedicated "Open in a specific directory" example with folder = "/home/coder/project".
Pre-installed extensions (web IDEs only)	6	N/A	VS Code Desktop is a desktop application, not a web IDE. Criterion excluded per rubric.

Overall — 80 / 100

Raw 68.5 / 86 → round(68.5 / 86 × 100) = 80

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.