Portable Desktop module

[bpmct]

A discussion dedicated to the Portable Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	18 / 20	10 / 10	81 / 100

Normalized: 81 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	8	README shows custom download URL with checksum, and custom install_dir examples. However, no example demonstrates skipping download when binary is pre-baked (the bring-your-own-binary path is not exemplified).
Coder-context framing	8	5	README mentions "Install portabledesktop for lightweight Linux desktop sessions over VNC" and notes the binary is "automatically available on PATH via CODER_SCRIPT_BIN_DIR," showing Coder integration. However, it does not explain what portabledesktop adds on top of Coder's existing capabilities or where Coder fits in the desktop access flow.
Visual preview	5	0	No image, GIF, or video in README. The icon reference is metadata, not an embedded visual preview.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The url and sha256 variables are not secrets. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Module does not require authentication credentials; it downloads a public binary. No auth path needed.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	The url variable (main.tf line 19-22) overrides the default GitHub download URL, allowing users to point to an internal mirror. README example demonstrates this with "https://example.com/portabledesktop-linux-x64".
Bring-your-own binary	5	5	run.sh lines 16-19 check if portabledesktop is already in PATH and exit early if found. Lines 25-27 skip download if the binary already exists at BINARY_PATH. This supports pre-baked images, though not explicitly documented in README.
Egress transparency	3	1.5	No dedicated README section enumerating external endpoints. The default URLs (github.com/coder/portabledesktop/releases) are visible only in main.tf source code. Mentions are scattered across examples, not consolidated for restricted environments.
Runs without sudo	2	1	run.sh uses sudo as a fallback for install_dir copy operations (lines 95-101). Core functionality (download, storage in CODER_SCRIPT_DATA_DIR, symlink to CODER_SCRIPT_BIN_DIR) works without sudo. The install_dir feature is optional, and the script attempts non-sudo copy first, falling back to sudo only if needed. This earns half credit per the rubric.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All four variables (agent_id, install_dir, url, sha256) have clear descriptions and sensible defaults (null for optional inputs). No validation blocks, but the inputs are straightforward strings where validation would add little value.
Test coverage	4	4	main.test.ts provides comprehensive end-to-end tests covering install success, checksum verification (both match and mismatch), checksum skip, sudo fallback, install_dir creation, and wget fallback. portabledesktop.tftest.hcl covers Terraform plan scenarios with required and optional variables. Clear testing story with both business logic and behavior coverage.

Overall — 81 / 100

Raw 61 / 75 → round(61 / 75 × 100) = 81

Track: Utility (portabledesktop is a desktop tool installer, not an AI agent or IDE)

Utility modules are scored on Universal criteria only (75 pts max), then normalized.

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.