Portable Desktop module

[bpmct]

A discussion dedicated to the Portable Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	19 / 20	10 / 10	91 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides three clear examples: basic usage, custom download URL with checksum verification, and custom install_dir. Each demonstrates a distinct configuration mode with sensible defaults.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference does not count as a visual preview.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secrets are used in this module. All inputs (agent_id, install_dir, url, sha256) are non-sensitive configuration values. README examples contain no API keys or credentials.
Non-hardcoded auth path	4	4	No authentication is required for this module's operation. It downloads a public binary from GitHub or a custom URL without credentials.

Restricted-Environment Readiness — 19 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	The url variable (line 23-27 in main.tf) allows overriding the default GitHub download URL, enabling pointing to an internal mirror. README example shows: url = "https://example.com/portabledesktop-linux-x64".
Bring-your-own binary	10	10	The run.sh script (lines 16-20) checks if portabledesktop is already in PATH and exits early if found. Lines 23-26 check if the binary already exists at BINARY_PATH and skip download. This allows pre-baking the binary into the image.
Egress transparency	3	2	No dedicated README section for network endpoints or air-gapped environments. The default GitHub URLs are visible in examples and code, but not enumerated in a dedicated section as required for full credit.
Runs without sudo	2	2	The run.sh script operates without sudo for core functionality. Sudo is only attempted as a fallback when copying to install_dir fails (lines 119-127), which is an optional feature. The script works fully without sudo when install_dir is not set or is writable.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All four variables have clear descriptions. Defaults are sensible (null for optional features). The sha256 variable could benefit from validation (regex for hex format), but descriptions are comprehensive and explain behavior clearly.
Test coverage	4	4	Comprehensive test suite in main.test.ts covers: basic installation, checksum verification (success and failure), custom install_dir with sudo fallback, directory creation, and wget fallback. The .tftest.hcl file covers Terraform plan validation for different variable combinations. Tests verify both business logic and end-to-end behavior.

Overall — 91 / 100

Raw 61 / 67 → round(61 / 67 × 100) = 91

Track: Utility (normalized from 67-point denominator)

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.