Portable Desktop module

[bpmct]

A discussion dedicated to the Portable Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	18 / 20	10 / 10	81 / 100

Normalized: 81 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	8	README shows custom download URL with checksum, and install_dir example. No examples for different deployment modes (e.g., with/without VNC apps, different desktop environments). Partial coverage of major configuration options.
Coder-context framing	8	5	README mentions "lightweight Linux desktop sessions over VNC" and links to portabledesktop GitHub, but does not explain what Coder adds on top or show where Coder fits in the user flow. Minimal context framing.
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. No secrets handling required. Full credit by construction.
Non-hardcoded auth path	4	4	No authentication required for this module. N/A by construction, full credit.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	Variable url (line 23-27 in main.tf) overrides the default GitHub download URL. README example shows custom URL usage. Full credit.
Bring-your-own binary	5	5	run.sh (lines 16-20) checks if portabledesktop is already in PATH and skips download. Lines 24-27 check if binary exists at BINARY_PATH and skip download. Documented implicitly through the skip logic. Full credit.
Egress transparency	3	1.5	No dedicated README section for network endpoints or air-gapped environments. GitHub URLs visible in examples but not enumerated in a dedicated section. At most half per rubric.
Runs without sudo	2	1.5	run.sh uses sudo only as fallback for install_dir copy (lines 109-117). Core functionality (download, verify, install to CODER_SCRIPT_DATA_DIR, symlink) works without sudo. Optional install_dir feature requires sudo for system paths. Half credit per rubric (sudo for optional feature with working fallback).

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs (agent_id, install_dir, url, sha256) have clear descriptions and sensible defaults (null for optional params). No validation blocks but types are appropriate. Full credit.
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts cover download, checksum verification, checksum mismatch, sudo fallback, install_dir creation, wget fallback. Terraform tests in portabledesktop.tftest.hcl cover plan scenarios. Clear testing story with both unit and integration coverage. Full credit.

Overall — 81 / 100

Raw 61 / 75 → round(61 / 75 × 100) = 81

Track: Utility (installs a desktop binary tool, not an agent or IDE)

---

Scored against SCORECARD.md on 2026-07-20 with claude-sonnet-4-5.