Windsurf Editor module

[bpmct]

A discussion dedicated to the Windsurf Editor module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	19 / 19	20 / 20	2 / 2 (N/A: Mirrorable, BYOB, Egress)	7 / 10	88 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README shows three distinct modes: default launch, folder override, and mcp config with a real coder_external_auth GitHub example — covers the module's main optional inputs with sensible defaults.
Visual preview	5	0	No image, GIF, or video embedded in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module defines no secret-bearing inputs; the only credential-related example uses data.coder_external_auth.github.access_token, no inline keys appear anywhere in the README.
Non-hardcoded auth path	4	4	MCP example explicitly documents OAuth via coder_external_auth (GitHub) instead of pasting an API key.

Restricted-Environment Readiness — 2 / 2 (N/A: Mirrorable artifact source, Bring-your-own binary, Egress transparency)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module installs nothing itself; it only builds a windsurf:// URI via vscode-desktop-core for a locally pre-installed desktop app.
Bring-your-own binary	10	N/A	No install step exists to disable; Windsurf Editor is assumed already present on the user's machine.
Egress transparency	3	N/A	No downloads/install occur from this module, so no endpoints to enumerate.
Runs without sudo	2	2	The windsurf_mcp coder_script only runs mkdir, base64 -d, and chmod against $HOME, with no sudo invocation anywhere.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All variables (folder, open_recent, order, group, slug, display_name, mcp) have clear descriptions and defaults, but none use validation blocks (e.g., no JSON validation on mcp, no slug format check).
Test coverage	4	4	main.test.ts exercises terraform apply for every flag combination and executes the generated coder_script inside a container to verify the MCP config file is written correctly — solid end-to-end TS coverage.

IDE Integration — 19 / 19 (N/A: Pre-installed extensions — desktop IDE, not web-based)

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app is provisioned via the vscode-desktop-core submodule, tested in main.test.ts confirming a windsurf-desktop/vscode-desktop coder_app resource with correct URI output.
Managed configuration	6	6	mcp variable documented with a working example writing ~/.codeium/windsurf/mcp_config.json via coder_script.
Configurable folder or workdir	6	6	folder variable documented with a dedicated "Open in a specific directory" example.
Pre-installed extensions (web IDEs only)	6	N/A	Windsurf Editor is a desktop app launched via protocol handler, not a web IDE — criterion does not apply.

Overall — 88 / 100

Raw 58 / 66 → round(58 / 66 × 100) = 88

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.

[matifali]

BTW, Windsurf Editor is now called Devin Desktop. May we also check for any upstream changes or deprecations?
https://devin.ai/blog/windsurf-is-now-devin-desktop/
cc: @bpmct