Portable Desktop module

[bpmct]

A discussion dedicated to the Portable Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	18 / 20	10 / 10	81 / 100

Final: 81 / 100 (Utility track)

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides three distinct examples: basic usage, custom download URL with checksum verification, and system path installation. Each demonstrates a different configuration mode with sensible defaults.
Coder-context framing	8	1	README mentions "Install [portabledesktop]...for lightweight Linux desktop sessions over VNC" and notes the binary is "automatically available on PATH via CODER_SCRIPT_BIN_DIR" (a Coder-specific environment variable), but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal Coder-context framing.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference in frontmatter does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The url and sha256 variables are not secrets. README examples contain no inline secrets. Full credit by construction.
Non-hardcoded auth path	4	4	No authentication required for this module. It downloads a public binary from GitHub or a custom URL. Full credit by construction.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	The url variable (line 23-26 in main.tf) overrides the default GitHub download URL. README example "Custom download URL with checksum verification" demonstrates setting url = "https://example.com/portabledesktop-linux-x64". This allows pointing to an internal mirror.
Bring-your-own binary	5	5	The run.sh script (lines 14-18) checks if portabledesktop is already in PATH and exits early if found. Lines 24-26 check if the binary already exists at BINARY_PATH and skip download. This supports pre-baked images. While not explicitly documented in a dedicated section, the behavior is clear and functional.
Egress transparency	3	1.5	No dedicated README section enumerating external endpoints. The default URLs (github.com/coder/portabledesktop/releases) are visible in examples and main.tf but scattered, not consolidated in a network/air-gapped section. Half credit for inferable endpoints without dedicated documentation.
Runs without sudo	2	1.5	The run.sh script uses sudo only as a fallback for optional install_dir copying (lines 95-104). Core functionality (download, storage in CODER_SCRIPT_DATA_DIR, symlinking to CODER_SCRIPT_BIN_DIR) works without sudo. However, the script does invoke sudo for the optional feature, and the mkdir fallback also tries sudo (line 93). Half credit: sudo used for optional features with working non-root fallback.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All four variables (agent_id, install_dir, url, sha256) have clear descriptions. Defaults are sensible (null for optional parameters). No validation blocks present, but the simple string types don't require complex validation.
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts cover: successful installation, checksum verification (both success and failure), checksum skipping, sudo fallback, install_dir creation, and wget fallback. The .tftest.hcl file covers basic plan scenarios with different variable combinations. Business logic and end-to-end behavior both tested.

Overall — 81 / 100

Raw 61 / 75 → round(61 / 75 × 100) = 81

Utility track (this module installs a desktop tool binary; it is neither an AI agent nor an IDE)

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.