RDP Desktop module

[bpmct]

A discussion dedicated to the RDP Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	12 / 20	0 / 2 (N/A 18 excluded)	7 / 10	66 / 100

Drilldown

Track: Utility (Windows RDP enablement/access tool — not an AI agent or an IDE; scored on Universal criteria only.)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides Basic Usage (defaults), Custom display name, and Generated credentials examples, covering the module's main practical variations with sensible defaults shown for each.
Visual preview	5	0	No image, GIF, or video embedded in the README — only an icon reference in frontmatter.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	password variable is marked sensitive = true, but the "Basic Usage" example inlines the literal default credential ("Password: coderRDP!") in prose, which per calibration caps this at half despite the sensitive flag.
Non-hardcoded auth path	4	4	"Generated credentials" example uses random_password resource and documents that the credential never lives in the template, passed via variable instead of a literal string.

Restricted-Environment Readiness — 0 / 2 (18 pts N/A, excluded)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing of its own — it only runs a bundled PowerShell script (configure-rdp.ps1) to toggle native Windows OS features (RDP, firewall, services). No download URL to mirror.
Bring-your-own binary	10	N/A	No install/download step exists by construction; nothing to disable.
Egress transparency	3	N/A	No external endpoints are contacted by the module itself (native OS configuration only).
Runs without sudo	2	0	Core functionality (enabling RDP, configuring Windows Firewall, setting admin password, starting services) inherently requires elevated/administrator privileges. No documentation addresses privilege requirements or a non-elevated fallback path, and configure-rdp.ps1 contents aren't shown to verify otherwise.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All variables (agent_id, agent_name, username, password, display_name, order, group) have clear descriptions and sensible defaults where applicable, but no validation blocks exist anywhere (e.g., non-empty username/password, order range checks).
Test coverage	4	4	.tftest.hcl thoroughly covers business logic (password escaping, special characters, URL encoding) via plan, and main.test.ts covers end-to-end behavior (app/script creation, custom values, URI structure) via apply.

Overall — 66 / 100

Raw 31 / 47 → round(31 / 47 × 100) = 66

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.