Portable Desktop module

[bpmct]

A discussion dedicated to the Portable Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	18 / 20	10 / 10	81 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for custom download URL with checksum verification and custom install_dir. Each example shows sensible defaults and different configuration modes.
Coder-context framing	8	1	README mentions "Install [portabledesktop]...for lightweight Linux desktop sessions" and notes the binary is "automatically available on PATH via CODER_SCRIPT_BIN_DIR" but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal Coder-context framing.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. All inputs (agent_id, install_dir, url, sha256) are non-sensitive configuration values. No inline secrets in examples.
Non-hardcoded auth path	4	4	Module does not require authentication credentials; downloads from public GitHub releases or user-specified URLs. No auth path needed.

Restricted-Environment Readiness — 18 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	The url variable (line 23-26 in main.tf) overrides the default GitHub download URL, allowing users to point to an internal mirror. Example shows url = "https://example.com/portabledesktop-linux-x64".
Bring-your-own binary	5	5	The run.sh script (lines 14-18) checks if portabledesktop is already in PATH and exits early if found. Lines 24-26 check if the binary already exists at BINARY_PATH and skip download. This supports pre-baked images.
Egress transparency	3	1	No dedicated README section enumerating external endpoints. The GitHub URLs are visible in examples but not consolidated in a network/air-gapped section. At most half, but only partial mention across examples earns 1 point.
Runs without sudo	2	2	The run.sh script operates without sudo for core functionality. Sudo is only attempted as a fallback when copying to install_dir (lines 95-103), which is optional. The script works fully without sudo when install_dir is not set or is writable.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (null for optional features). The sha256 variable could benefit from validation (regex for hex format), but descriptions are comprehensive.
Test coverage	4	4	Comprehensive test coverage in main.test.ts with 8 test cases covering download, checksum verification, sudo fallback, wget fallback, install_dir creation, and error cases. The .tftest.hcl file covers basic Terraform plan scenarios. Business logic and end-to-end behavior both tested.

Overall — 81 / 100

Raw 61 / 75 → round(61 / 75 × 100) = 81

Track: Utility (portabledesktop is a desktop tool installer, not an AI agent or IDE)

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.