VS Code Desktop module

[bpmct]

A discussion dedicated to the VS Code Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	17 / 25	20 / 20	N/A	8 / 10	73 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage and opening in a specific directory, covering the major configuration modes (default vs. folder-specific).
Coder-context framing	8	1	README mentions "Add a button to open any workspace" and references the Coder Remote VS Code Extension, but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal context provided.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference which does not count.

IDE Integration — 17 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module uses coder_app via the vscode-desktop-core submodule (visible in test assertions checking for coder_app resource). Proper launch behavior with vscode:// protocol URLs.
Managed configuration	6	0	No documented support for managed IDE settings or configuration. Module only handles launch URLs.
Configurable folder or workdir	6	6	folder variable documented with example showing "/home/coder/project". Tests verify folder parameter in URL construction.
Pre-installed extensions	6	4	N/A - desktop IDE, not a web IDE. This criterion does not apply.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. The module uses $SESSION_TOKEN in URLs which is handled by Coder's built-in token mechanism, not user-provided secrets. No inline secrets in examples.
Non-hardcoded auth path	4	4	Uses Coder's native session token mechanism ($SESSION_TOKEN) rather than requiring users to paste API keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only constructs URLs and creates coder_app resources. No artifacts to mirror.
Bring-your-own binary	5	N/A	Module downloads nothing; it assumes VS Code Desktop is already installed on the user's local machine.
Egress transparency	3	N/A	Module makes no network calls itself; it only generates URLs for the client to use.
Runs without sudo	2	N/A	Module contains no scripts to execute.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and sensible defaults (folder="", open_recent=false, order=null). However, no validation blocks present for any inputs.
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts covering default output, folder parameter, open_recent parameter, and combinations. Tests verify URL construction and coder_app resource creation. No .tftest.hcl file, but business logic is minimal (URL construction) and well-covered by TypeScript tests.

Overall — 73 / 100

Raw 58 / 80 → round(58 / 80 × 100) = 73

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.