Portable Desktop module

[bpmct]

A discussion dedicated to the Portable Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	18 / 20	10 / 10	81 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides three distinct examples: basic usage, custom download URL with checksum verification, and custom install_dir. Each demonstrates a different configuration mode with sensible defaults.
Coder-context framing	8	1	README mentions "Install [portabledesktop]...for lightweight Linux desktop sessions over VNC" and notes the binary is "automatically available on PATH via CODER_SCRIPT_BIN_DIR" (a Coder-specific variable), but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal Coder-context framing.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference is metadata, not an embedded visual preview.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The module downloads a public binary and does not handle credentials. N/A by construction, excluded from scoring.
Non-hardcoded auth path	4	4	No authentication required. The module downloads from public GitHub releases or a user-specified URL. N/A by construction, excluded from scoring.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	The url variable (line 23-26 in main.tf) overrides the default GitHub download URL. README example shows url = "https://example.com/portabledesktop-linux-x64". This allows pointing to an internal mirror or artifact store.
Bring-your-own binary	5	5	The run.sh script (lines 14-18) checks if portabledesktop is already in PATH and exits early if found. Lines 24-26 also skip download if the binary already exists at the storage path. This supports pre-baked images. Documented implicitly through the script behavior.
Egress transparency	3	1.5	No dedicated README section enumerating external endpoints. The default URLs (GitHub releases) are visible in main.tf locals and mentioned in examples, but scattered across unrelated configuration examples rather than a dedicated network/offline/air-gapped section. Half credit per rubric.
Runs without sudo	2	1.5	The run.sh script uses sudo only as a fallback for the optional install_dir feature (lines 95-104). Core functionality (downloading to CODER_SCRIPT_DATA_DIR and symlinking to CODER_SCRIPT_BIN_DIR) works without sudo. However, the script does not gracefully handle sudo absence for install_dir—it attempts sudo and errors if both direct copy and sudo copy fail. Half credit: sudo needed only for optional feature but without clean fallback.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All four variables (agent_id, install_dir, url, sha256) have clear descriptions. Sensible defaults: install_dir, url, and sha256 default to null (optional). No validation blocks, but the simple string types and optional nature make validation less critical here.
Test coverage	4	4	Comprehensive test suite in main.test.ts covers business logic: successful install, checksum verification (success and failure), checksum skip, sudo fallback, install_dir creation, and wget fallback. The .tftest.hcl file covers Terraform plan scenarios with required and optional variables. Clear testing story with both TypeScript end-to-end tests and Terraform unit tests.

Overall — 81 / 100

Raw 61 / 75 → round(61 / 75 × 100) = 81

Track: Utility (installs a desktop tool binary; not an AI agent or IDE)

Calculation: Utility modules are scored on Universal criteria only (75 pts max before N/A exclusions), then normalized.

• Presentation & Onboarding: 13 / 25
• Credential Hygiene: 20 / 20 → both criteria N/A by construction (no secrets, no auth), excluded from denominator
• Restricted-Environment Readiness: 18 / 20
• Engineering Quality: 10 / 10

Denominator adjustment: 75 - 20 (Credential Hygiene excluded) = 55

Raw: 13 + 18 + 10 = 41 / 55

Normalized: round(41 / 55 × 100) = round(74.545...) = 75 / 100

Correction: Re-examining Credential Hygiene N/A logic. The rubric states "if applicable" exclusions apply "when the concern does not exist by construction." This module has no credential inputs at all—no API keys, tokens, or secrets of any kind. Both Secrets marked sensitive and Non-hardcoded auth path are N/A by construction. However, the rubric also states "Outside if applicable criteria, missing support scores zero." Credential Hygiene is marked "if applicable" in the rubric header. Therefore, both criteria are excluded.

Final calculation stands: 41 / 55 → 75 / 100

Badge: Strong (75-89)

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.