VS Code Desktop module

[bpmct]

A discussion dedicated to the VS Code Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	13 / 19	20 / 20	7 / 20	10 / 10	65 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README documents three examples: default, folder, and extensions. However, open_recent (a meaningful behavioral toggle), order, and group have no README examples. The three major modes are covered, but not all options are demonstrated.
Visual preview	5	0	No image, GIF, or video in the README. The frontmatter icon field is a registry listing icon, not a visual preview of the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. All variables (agent_id, folder, open_recent, order, group, extensions) are non-secret configuration values. No inline secrets in README examples.
Non-hardcoded auth path	4	4	Auth is handled via Coder's $SESSION_TOKEN embedded in the vscode:// URI and the agent_id reference. No raw keys are pasted into templates.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The install script hardcodes https://update.code.visualstudio.com/... URLs. No module input variable overrides the download URL. SERVER_DIRECTORY_B64 controls install location, not source.
Bring-your-own binary	10	5	The script checks if [ -x "$IDE_CLI_PATH" ]; then exit 0; fi, skipping download when the CLI already exists. The README states "Later workspace starts reuse the existing VS Code Server CLI and do not force extension updates," and the TS test verifies this. However, the README frames this as a caching behavior for restarts, not as an explicit "pre-install in your image" instruction.
Egress transparency	3	0	No dedicated network/egress/air-gapped section. The line "The workspace also needs HTTPS egress to the VS Code update and artifact hosts" appears inline within the extensions example and does not enumerate specific domains (e.g., update.code.visualstudio.com, marketplace.visualstudio.com).
Runs without sudo	2	2	The install script (scripts/install-remote-server.sh.tftpl) never invokes sudo. All operations (mktemp, mkdir, tar, mv, curl/wget) target $HOME/.coder-modules/... and run as the unprivileged user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All six variables have clear description fields and sensible defaults. extensions includes a validation block rejecting empty strings. order and group default to null (valid for optional pass-through).
Test coverage	4	4	main.tftest.hcl covers URL construction (default, extensions acceptance, empty-ID rejection). main.test.ts provides end-to-end coverage: URL parameter combinations, coder_app resource verification, extension script content inspection (URLs, paths, start_blocks_login, timeout), and a live container test confirming skip-download when CLI is pre-existing.

IDE Integration — 13 / 19

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates a coder_app resource (verified in TS test: res.type === "coder_app", res.name === "vscode-desktop"). Passes coder_app_icon, coder_app_slug, coder_app_display_name, coder_app_order, coder_app_group to the core. Launches via vscode:// protocol URI.
Managed configuration	6	0	No documented support for managed VS Code settings, keybindings, or policies. config_dir = "$HOME/.vscode" is passed to the core module but no README section or variable exposes settings injection.
Configurable folder or workdir	6	6	folder variable with clear description and README example ("Open in a specific directory" with folder = "/home/coder/project"). open_recent provides additional workdir behavior.
Pre-installed extensions (web IDEs only)	6	N/A	VS Code Desktop is a desktop application, not a web IDE. Criterion does not apply.

Overall — 65 / 100

Raw 56 / 86 → round(56 / 86 × 100) = 65

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.