Windsurf Editor module

[bpmct]

A discussion dedicated to the Windsurf Editor module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	19 / 19	12 / 20	2 / 2	7 / 10	76 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents three major modes with examples: default (agent_id only), folder (folder = "/home/coder/project"), and MCP configuration (mcp = jsonencode(...)). Minor UI variables (open_recent, order, group, slug, display_name) are not major modes and need not each have a dedicated example.
Visual preview	5	0	No embedded image, GIF, or video in the README. The frontmatter references an SVG icon file, but that is not a visual preview of the module in action.

IDE Integration — 19 / 19

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates a coder_app via the vscode-desktop-core sub-module. Test verifies coder_app resource with module.vscode-desktop-core and name vscode-desktop. README states "Add a button to open any workspace with a single click."
Managed configuration	6	6	mcp input variable writes ~/.codeium/windsurf/mcp_config.json on workspace start. README documents this with a full example using coder_external_auth for GitHub MCP.
Configurable folder or workdir	6	6	folder variable (default "") and open_recent boolean (default false) are documented with README examples showing folder = "/home/coder/project".
Pre-installed extensions	6	N/A	Windsurf Editor is a desktop application accessed via the windsurf:// protocol, not a web IDE. Criterion applies only to web IDEs.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The mcp variable (a JSON string that can embed auth tokens/headers) is not marked sensitive = true in main.tf. README examples avoid inline literal secrets (uses ${data.coder_external_auth.github.access_token} reference), but the missing sensitive flag on a variable that carries credentials caps this at half.
Non-hardcoded auth path	4	4	README MCP example uses data "coder_external_auth" "github" to obtain the access token, avoiding pasting a raw key into the template.

Restricted-Environment Readiness — 2 / 2

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads and installs nothing of its own. It creates a coder_app URL and optionally writes a local JSON file. No binary or artifact is fetched.
Bring-your-own binary	10	N/A	No download or install step exists in this module.
Egress transparency	3	N/A	No external endpoints are contacted by the module itself. The coder_app URL is consumed by the user's local editor, not by the workspace.
Runs without sudo	2	2	The sole script (coder_script "windsurf_mcp") runs mkdir -p "$HOME/.codeium/windsurf", writes a file, and chmod 600—all within $HOME. No sudo invocation anywhere in the script.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All 8 variables have clear descriptions and sensible defaults. However, no validation blocks are present (e.g., mcp could validate JSON format, folder could validate path syntax). Half credit for missing validation.
Test coverage	4	4	main.test.ts covers URL construction (default, folder, open_recent combinations), verifies coder_app resource creation, and includes a container-based integration test that executes the MCP script and asserts file contents. Business logic is well covered.

Overall — 76 / 100

Raw 52 / 68 → round(52 / 68 × 100) = 76

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.

[matifali]

BTW, Windsurf Editor is now called Devin Desktop. May we also check for any upstream changes or deprecations?
https://devin.ai/blog/windsurf-is-now-devin-desktop/
cc: @bpmct