VS Code Desktop module

[bpmct]

A discussion dedicated to the VS Code Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	18 / 25	20 / 20	N/A	8 / 10	72 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows two examples: default and "open in a specific directory". These cover the main configuration modes (with/without folder), but the module has additional options (open_recent, order, group) that lack documented examples. Half credit.
Visual preview	5	0	README includes an icon reference (icon: ../../../../.icons/code.svg) but no embedded image, GIF, or video showing the module in action.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates a coder_app via the vscode-desktop-core submodule with proper VS Code Desktop launch behavior using the vscode:// protocol. Test confirms coder_app resource is created.
Managed configuration	6	0	No documented support for managed IDE settings or configuration. The module only handles launching VS Code Desktop, not managing its settings.
Configurable folder or workdir	6	6	The folder variable is documented and demonstrated in the "Open in a specific directory" example. Tests verify folder parameter is correctly added to the URL.
Pre-installed extensions	6	5	N/A - VS Code Desktop is not a web IDE, so this criterion does not apply.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. The module uses $SESSION_TOKEN in the generated URL (visible in tests), which is a Coder-managed token, not a user-provided secret. No README examples inline secrets.
Non-hardcoded auth path	4	4	Authentication is handled via Coder's session token mechanism ($SESSION_TOKEN), which is a proper OAuth/session-based approach rather than requiring users to paste raw keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing; it only creates a coder_app resource with a vscode:// URL. No artifacts to mirror.
Bring-your-own binary	10	N/A	Module downloads nothing; it only creates a coder_app resource. No binary installation to skip.
Egress transparency	3	N/A	Module makes no external network calls of its own; it only creates a coder_app that launches VS Code Desktop on the user's machine.
Runs without sudo	2	N/A	Module contains no scripts to execute.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Variables include: agent_id (required, clear description), folder (optional with default ""), open_recent (bool with clear description and default false), order (number with clear description and default null), group (string with clear description and default null). No validation blocks present, but the simple string/bool/number types are appropriate for these inputs.
Test coverage	4	2	Tests in main.test.ts cover URL generation logic well (default, folder, open_recent combinations). However, tests are purely unit-level checking Terraform outputs; no end-to-end tests verify actual VS Code Desktop launch behavior. Half credit.

Overall — 72 / 100

Raw 52 / 72 → round(52 / 72 × 100) = 72

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.