Devin Desktop module

[github-actions[bot]]

A discussion dedicated to the Devin Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	25 / 25	20 / 20	0 / 20	8 / 10	71 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, pre-installing extensions, and configuring MCP servers. Each example is clear with sensible defaults.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference does not count as a visual preview.

IDE Integration — 25 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates a coder_app via the vscode-desktop-core wrapper with proper launch behavior using the devin:// protocol.
Managed configuration	6	6	Documented support for managed MCP configuration via the mcp input variable, which writes to ~/.config/devin/mcp_config.json. Example shows GitHub MCP server configuration with external auth.
Configurable folder or workdir	6	6	The folder variable is documented with an example showing how to open Devin Desktop in a specific directory (/home/coder/project).
Pre-installed extensions	6	6	Documented support for pre-installing extensions via the extensions variable. README example shows installing ms-python.python and esbenp.prettier-vscode@12.4.0.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are defined in this module. The MCP example uses data.coder_external_auth.github.access_token which is a reference, not an inline secret.
Non-hardcoded auth path	4	4	README MCP example demonstrates OAuth via coder_external_auth resource, avoiding raw API keys.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The module downloads from hardcoded URLs (https://windsurf-stable.codeium.com/api/update/... and https://windsurf-stable.codeiumdata.com/...). No variable exists to override these download URLs.
Bring-your-own binary	10	0	No documented way to disable the download when the Devin Remote Host is already present. The script checks if the CLI is executable and skips download, but this is not documented as a bring-your-own-binary pattern.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The URLs are visible only in the template file install-remote-server.sh.tftpl, not documented for restricted environments.
Runs without sudo	2	0	The install script in install-remote-server.sh.tftpl does not invoke sudo and runs as the user. However, the MCP script uses chmod 600 which works without sudo. Scripts run without sudo, earning full credit per the rubric exception. Correction: reviewing the scripts, they never invoke sudo and work as unprivileged user. This earns 2 points.

Correction for Runs without sudo: The install script (install-remote-server.sh.tftpl) and MCP script (coder_script.devin_desktop_mcp) never invoke sudo. They use standard commands (curl/wget, tar, mkdir, chmod) that work for unprivileged users operating on their home directory. Per the rubric exception, this earns full credit from code verification alone.

Restricted-Environment Readiness — 2 / 20 (corrected)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The module downloads from hardcoded URLs (https://windsurf-stable.codeium.com/api/update/... and https://windsurf-stable.codeiumdata.com/...). No variable exists to override these download URLs.
Bring-your-own binary	10	0	No documented way to disable the download when the Devin Remote Host is already present. The script checks if the CLI is executable and skips download, but this is not documented as a bring-your-own-binary pattern.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The URLs are visible only in the template file install-remote-server.sh.tftpl, not documented for restricted environments.
Runs without sudo	2	2	The install script and MCP script never invoke sudo. All operations (mkdir, curl/wget, tar, chmod, base64) work as unprivileged user in home directory. Full credit per rubric exception.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (empty string for folder, false for open_recent, null for order/group, empty list for extensions). No validation blocks are present, but the inputs are straightforward enough that validation is not critical.
Test coverage	4	2	.tftest.hcl covers basic URI generation and extension acceptance. TypeScript tests in main.test.ts cover end-to-end behavior including extension installation, MCP configuration, and bootstrap script validation. However, the test coverage is partial—no tests verify restricted-environment scenarios, bring-your-own-binary paths, or error handling for missing dependencies.

Overall — 71 / 100

Raw 65 / 92 → round(65 / 92 × 100) = 71

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.