VS Code Desktop module

[bpmct]

A discussion dedicated to the VS Code Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	17 / 25	20 / 20	N/A	8 / 10	73 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage and opening in a specific directory, covering the major configuration modes (default vs. folder-specific).
Coder-context framing	8	1	README mentions "Add a button to open any workspace" and references the Coder Remote VS Code Extension, but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal context provided.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference which does not count.

IDE Integration — 17 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module uses coder_app via the vscode-desktop-core submodule (visible in test assertions checking for coder_app resource). Proper launch behavior with vscode:// protocol URLs.
Managed configuration	6	0	No documented support for managed IDE settings or configuration. Module only handles launch URL construction.
Configurable folder or workdir	6	6	folder variable documented with example showing "/home/coder/project". Tests verify folder parameter in URL construction.
Pre-installed extensions	6	4	Not applicable for desktop VS Code (this criterion is web IDEs only), but the module does reference the Coder Remote VS Code Extension as a dependency. Partial credit for extension awareness but not pre-installation.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. The module constructs URLs using $SESSION_TOKEN placeholder (visible in tests), which is handled by Coder's built-in token mechanism, not user-provided secrets. No inline secrets in examples.
Non-hardcoded auth path	4	4	Uses Coder's native session token mechanism ($SESSION_TOKEN in URL), avoiding raw key management entirely.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only constructs URLs and creates coder_app resources. No artifacts to mirror.
Bring-your-own binary	5	N/A	Module downloads nothing; it delegates to the vscode-desktop-core submodule which also appears to only construct URLs. No binary installation.
Egress transparency	3	N/A	Module makes no external network calls of its own; it only constructs vscode:// protocol URLs.
Runs without sudo	2	N/A	No scripts present in this module.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and sensible defaults (folder="", open_recent=false, order=null). Missing validation blocks for any inputs. Descriptions are clear but could be more detailed.
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts covering default output, folder parameter, open_recent parameter, and combinations. Tests verify URL construction and coder_app resource creation. No .tftest.hcl file, but TypeScript tests provide good end-to-end coverage.

Overall — 73 / 100

Raw 58 / 80 → round(58 / 80 × 100) = 73

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.