VS Code Desktop module

[bpmct]

A discussion dedicated to the VS Code Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	16 / 19 (pre-installed extensions N/A)	18 / 20	7 / 20	10 / 10	70 / 100

Drilldown

Track: IDE (VS Code Desktop is a desktop editor, not an AI agent; Pre-installed extensions criterion excluded as this is not a web IDE)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README has distinct, sensible-default examples for default launch, folder open, and extension pre-install (extensions), covering the module's main modes.
Visual preview	5	0	No image, GIF, or video embedded in the README.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secret/token variables exist in this module; the session token is injected automatically into the vscode:// URL by the core module and never shown as a literal in README examples.
Non-hardcoded auth path	4	2	Token handling is implicit via Coder's built-in session mechanism, but the README never documents this as a deliberate non-hardcoded auth path.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	install-remote-server.sh.tftpl hardcodes https://update.code.visualstudio.com/...; no module variable overrides this download URL.
Bring-your-own binary	10	5	README states "Later workspace starts reuse the existing VS Code Server CLI" and the install script skips download if code-server already exists at the fixed path, but this is not documented as an explicit opt-out/bring-your-own-binary mechanism.
Egress transparency	3	0	Only a single sentence inside the extensions example mentions needing "HTTPS egress to the VS Code update and artifact hosts" — no dedicated section, no enumerated endpoints.
Runs without sudo	2	2	install-remote-server.sh.tftpl never invokes sudo; runs entirely as the agent user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables (agent_id, folder, open_recent, order, group, extensions) have clear descriptions, sensible defaults, and extensions has a validation block rejecting empty IDs.
Test coverage	4	4	Both .tftest.hcl (plan-level logic/validation) and main.test.ts (end-to-end apply, output assertions, bootstrap script decoding/execution in a container) are present and substantive.

IDE Integration — 16 / 19 (Pre-installed extensions N/A)

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app is provided via the vscode-desktop-core submodule; README's one-click button behavior is documented and tested (main.test.ts confirms coder_app resource).
Managed configuration	6	3	Extension pre-install is documented, but no broader managed settings/config (e.g., settings.json) is addressed.
Configurable folder or workdir	6	6	Documented folder example opens a specific directory.
Pre-installed extensions (web IDEs only)	6	N/A	Not applicable — VS Code Desktop is a native desktop client, not a web IDE.

Overall — 70 / 100

Raw 47 / 67 → round(47 / 67 × 100) = 70

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.