VS Code Desktop module

[bpmct]

A discussion dedicated to the VS Code Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	17 / 25	20 / 20	N/A	8 / 10	73 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Two documented examples: default usage and opening in a specific directory. Both show sensible defaults.
Coder-context framing	8	1	README mentions "Add a button to open any workspace" and references the Coder Remote VS Code Extension, but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal context.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference.

IDE Integration — 17 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Uses coder_app via the vscode-desktop-core module with proper launch behavior (vscode:// protocol URL).
Managed configuration	6	0	No documented support for managed IDE settings or configuration.
Configurable folder or workdir	6	6	folder variable documented with example showing "/home/coder/project".
Pre-installed extensions	6	4	N/A - desktop IDE, not web IDE. Criterion excluded.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secrets or sensitive inputs in this module. Uses $SESSION_TOKEN in URL which is handled by Coder. No inline secrets in examples.
Non-hardcoded auth path	4	4	Uses Coder's built-in session token mechanism ($SESSION_TOKEN), avoiding raw key management.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only constructs URLs and creates coder_app resources.
Bring-your-own binary	5	N/A	Module downloads nothing; it only constructs URLs and creates coder_app resources.
Egress transparency	3	N/A	Module downloads nothing; it only constructs URLs and creates coder_app resources.
Runs without sudo	2	N/A	No scripts executed by this module.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions and sensible defaults. agent_id is required. folder, open_recent, order, and group have appropriate types and defaults.
Test coverage	4	2	TypeScript tests cover URL construction logic well (default, folder, open_recent combinations). No .tftest.hcl files present. Tests verify coder_app creation but focus on URL output rather than end-to-end IDE behavior.

Overall — 73 / 100

Raw 58 / 80 → round(58 / 80 × 100) = 73

Wait, recalculating: 13 + 17 + 20 + 8 = 58 out of 75 possible (IDE track 25, but Pre-installed extensions N/A reduces it to 19, so denominator is 25 - 6 + 19 = wait, let me recalculate properly.

Universal: 25 + 20 + 20 (N/A) + 10 = 75, but Restricted-Environment is N/A, so 25 + 20 + 10 = 55 possible for universal.
IDE track: 25 possible, but Pre-installed extensions (6) is N/A for desktop, so 19 possible.
Total denominator: 55 + 19 = 74
Total score: 13 + 20 + 8 + 17 = 58
Normalized: round(58 / 74 × 100) = round(78.38) = 78 / 100

Actually, re-reading rubric: IDE track is 25 pts total. Pre-installed extensions is 6 pts and N/A for desktop. So IDE track denominator becomes 25 - 6 = 19.
Universal without Restricted-Environment: 25 + 20 + 10 = 55
Total: 55 + 19 = 74
Score: 13 + 20 + 8 + 17 = 58
round(58/74 * 100) = 78

Let me recalculate the IDE track score: Dashboard (7/7) + Managed config (0/6) + Configurable folder (6/6) + Pre-installed N/A = 13 out of 19 possible.

Wait, the rubric says for N/A: "excluded from the denominator and the final score is normalized to 100". So:

• Universal criteria available: 25 (Presentation) + 20 (Credential) + 0 (Restricted N/A) + 10 (Engineering) = 55
• IDE track available: 7 + 6 + 6 = 19 (Pre-installed extensions N/A)
• Total available: 74
• Total scored: 13 + 20 + 8 + 13 = 54

Hmm, let me recalculate IDE: 7 + 0 + 6 = 13. Yes.

Total: 13 + 13 + 20 + 8 = 54 out of 74 → round(54/74 * 100) = round(72.97) = 73

Actually I need to recount. Let me be very careful:

Presentation & Onboarding: 12 + 1 + 0 = 13 / 25
Credential Hygiene: 16 + 4 = 20 / 20
Restricted-Environment: N/A (all four criteria N/A)
Engineering Quality: 6 + 2 = 8 / 10
IDE Integration: 7 + 0 + 6 = 13 / 19 (pre-installed extensions N/A)

Total scored: 13 + 20 + 8 + 13 = 54
Total possible: 25 + 20 + 10 + 19 = 74
Normalized: round(54 / 74 * 100) = round(72.973) = 73 / 100

Wait, I need to recalculate and fix the table:

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	13 / 19	20 / 20	N/A	8 / 10	73 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Two documented examples: default usage and opening in a specific directory. Both show sensible defaults.
Coder-context framing	8	1	README mentions "Add a button to open any workspace" and references the Coder Remote VS Code Extension, but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal context.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secrets or sensitive inputs in this module. Uses $SESSION_TOKEN in URL which is handled by Coder. No inline secrets in examples.
Non-hardcoded auth path	4	4	Uses Coder's built-in session token mechanism ($SESSION_TOKEN), avoiding raw key management.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only constructs URLs and creates coder_app resources.
Bring-your-own binary	5	N/A	Module downloads nothing; it only constructs URLs and creates coder_app resources.
Egress transparency	3	N/A	Module downloads nothing; it only constructs URLs and creates coder_app resources.
Runs without sudo	2	N/A	No scripts executed by this module.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions and sensible defaults. agent_id is required. folder, open_recent, order, and group have appropriate types and defaults.
Test coverage	4	2	TypeScript tests cover URL construction logic well (default, folder, open_recent combinations). No .tftest.hcl files present. Tests verify coder_app creation but focus on URL output rather than end-to-end IDE behavior.

IDE Integration — 13 / 19

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Uses coder_app via the vscode-desktop-core module with proper launch behavior (vscode:// protocol URL).
Managed configuration	6	0	No documented support for managed IDE settings or configuration.
Configurable folder or workdir	6	6	folder variable documented with example showing "/home/coder/project".
Pre-installed extensions	6	N/A	Desktop IDE, not web IDE. Criterion excluded.

Overall — 73 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.