VS Code Desktop module

[bpmct]

A discussion dedicated to the VS Code Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	25 / 25	20 / 20	0 / 20	8 / 10	71 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, and pre-installing extensions. Each example is clear with sensible defaults.
Visual preview	5	0	README references an icon file but does not embed an actual image, GIF, or video showing the module in action.

IDE Integration — 25 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates coder_app via the vscode-desktop-core submodule with proper VS Code Desktop launch behavior using the vscode:// protocol.
Managed configuration	6	6	The folder variable is documented and controls the workspace folder opened in VS Code. The open_recent variable controls whether to open the most recent workspace.
Configurable folder or workdir	6	6	The folder variable is explicitly documented with an example showing how to open VS Code in a specific directory (/home/coder/project).
Pre-installed extensions	6	6	The extensions variable is documented with examples showing how to pre-install VS Code extensions by ID, including version pinning support (esbenp.prettier-vscode@12.4.0).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are present in this module. The module uses agent_id and extension IDs, none of which are secrets. README examples do not inline any secrets.
Non-hardcoded auth path	4	4	Authentication is handled via the Coder Remote VS Code Extension and $SESSION_TOKEN, avoiding raw key pasting. The vscode:// URL scheme integrates with Coder's authentication system.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The VS Code Server download URLs are hardcoded in install-remote-server.sh.tftpl (https://update.code.visualstudio.com/...). No module variable exists to override these URLs.
Bring-your-own binary	10	0	The script checks if the CLI is executable and exits early if so, but there is no documented way to disable the download/install entirely or configure a pre-installed VS Code Server path. The check is an optimization, not a documented bring-your-own-binary feature.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The VS Code update and artifact hosts are mentioned in passing in the extension example but not in a dedicated network/offline/air-gapped section.
Runs without sudo	2	0	The install-remote-server.sh.tftpl script does not invoke sudo and operates in user space ($HOME). Full credit earned from code inspection.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions and sensible defaults. The extensions variable includes validation to reject empty extension IDs. Types are appropriate (string, bool, number, list).
Test coverage	4	2	.tftest.hcl covers basic business logic (URI format, extension acceptance/rejection). TypeScript tests in main.test.ts cover end-to-end behavior including bootstrap script decoding, extension installation, and VS Code Server download logic. However, the test coverage is moderate rather than comprehensive—missing tests for error conditions, network failures, and edge cases in the installation script.

Overall — 71 / 100

Raw 65 / 92 → round(65 / 92 × 100) = 71

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.