Portable Desktop module

[bpmct]

A discussion dedicated to the Portable Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	18 / 20	10 / 10	81 / 100

After normalization: 81 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for custom download URL with checksum verification and custom install_dir. These cover the major configuration modes.
Coder-context framing	8	1	README mentions "Install portabledesktop for lightweight Linux desktop sessions" and notes the binary is "automatically available on PATH via CODER_SCRIPT_BIN_DIR", but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal framing.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference is metadata, not an embedded visual preview.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The url and sha256 variables are not secrets. README examples do not inline secrets. Full credit by construction.
Non-hardcoded auth path	4	4	No authentication required for this module. Full credit by construction.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	The url variable (main.tf line 19-22) overrides the default GitHub download URL. README example shows url = "https://example.com/portabledesktop-linux-x64". This allows pointing to an internal mirror.
Bring-your-own binary	5	5	The run.sh script (lines 16-20) checks if portabledesktop is already in PATH and exits early if found. Lines 26-28 also skip download if the binary already exists at BINARY_PATH. This supports pre-baked images. Not explicitly documented in README but verifiable in code.
Egress transparency	3	1.5	No dedicated README section enumerating external endpoints. The default URLs (github.com) are visible in examples and main.tf but scattered, not consolidated in a network/air-gapped section. Half credit for inferable endpoints.
Runs without sudo	2	1.5	The run.sh script uses sudo only as a fallback for install_dir operations (lines 104-112). Core functionality (download, verify, install to CODER_SCRIPT_DATA_DIR, symlink to CODER_SCRIPT_BIN_DIR) works without sudo. Sudo is optional for the install_dir feature. Half credit per rubric: "sudo needed only for optional features with a working fallback earns half".

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions. The url and sha256 variables have sensible defaults (null). The install_dir variable documents its optional nature. No validation blocks needed for these string inputs.
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts cover download, checksum verification, checksum mismatch, sudo fallback, install_dir creation, and wget fallback. The .tftest.hcl file covers Terraform plan scenarios with required and optional variables. Clear testing story with both business logic and end-to-end behavior.

Overall — 81 / 100

Raw 61 / 75 → round(61 / 75 × 100) = 81

Track: Utility (this module installs a tool binary; it is not an AI agent or IDE)

Utility modules are scored on Universal criteria only (75 pts max), then normalized:

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.