Devin Desktop module

[github-actions[bot]]

A discussion dedicated to the Devin Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	23 / 25	20 / 20	0 / 20	8 / 10	68 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, pre-installing extensions, and configuring MCP servers. Each example is clear with sensible defaults.
Visual preview	5	0	README references an icon (icon: ../../../../.icons/devin.svg) but does not embed an actual image, GIF, or video showing the module in action.

IDE Integration — 23 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates a coder_app via the vscode-desktop-core wrapper with proper launch behavior using the devin:// protocol. The app is fully documented with customizable slug and display_name.
Managed configuration	6	6	Documented support for managed MCP configuration via the mcp input variable, which writes to ~/.config/devin/mcp_config.json. Example shows GitHub MCP server configuration with external auth.
Configurable folder or workdir	6	6	The folder variable is documented and demonstrated in examples, allowing the IDE to open in a configured directory.
Pre-installed extensions	6	4	The extensions variable is documented with an example showing how to pre-install VS Code-compatible extensions. However, the documentation does not explicitly mention that installation blocks login for up to 30 minutes or detail the fallback behavior on subsequent starts, though this is mentioned in the extension installation description. The mechanism is present but under-documented regarding the blocking behavior's implications.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The module does not handle secrets directly. The MCP example uses data.coder_external_auth.github.access_token which is a reference, not an inline secret. No sensitive inputs are defined in the module itself.
Non-hardcoded auth path	4	4	README example demonstrates OAuth via coder_external_auth for GitHub MCP server authentication, avoiding raw API keys.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The module hardcodes the Devin Remote Host download URL (https://windsurf-stable.codeium.com/api/update/linux-reh-$remote_arch/stable/latest) in install-remote-server.sh.tftpl. No module input variable allows overriding this URL to point to an internal mirror.
Bring-your-own binary	10	0	No documented way to disable the download/install when the Devin Remote Host is already present. The script checks if the CLI is executable and exits early (if [ -x "$IDE_CLI_PATH" ]; then exit 0), but this is a cache mechanism, not a documented bring-your-own-binary mode.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The URLs (windsurf-stable.codeium.com, windsurf-stable.codeiumdata.com) are visible only in the template script, not documented for restricted environments.
Runs without sudo	2	0	The install script in install-remote-server.sh.tftpl does not invoke sudo and operates in user space. However, the MCP configuration script uses chmod 600, which works without sudo. Both scripts run without requiring root privileges. Actually, reviewing the scripts: install-remote-server.sh.tftpl uses standard commands (curl/wget, tar, mkdir, mv) without sudo, and devin_desktop_mcp script uses mkdir, base64, and chmod without sudo. Both work as unprivileged user. Full credit: 2.

Correction after re-review: The install script and MCP script both operate without sudo. Awarding full credit.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The module hardcodes the Devin Remote Host download URL (https://windsurf-stable.codeium.com/api/update/linux-reh-$remote_arch/stable/latest) in install-remote-server.sh.tftpl. No module input variable allows overriding this URL.
Bring-your-own binary	10	0	No documented way to disable download when the tool is pre-installed. The script's early-exit check (if [ -x "$IDE_CLI_PATH" ]) is an implementation detail, not a documented bring-your-own-binary mode.
Egress transparency	3	0	No dedicated README section enumerates external endpoints contacted. The domains are visible only in source code.
Runs without sudo	2	2	Both install-remote-server.sh.tftpl and the MCP configuration script operate entirely with user-space commands (curl/wget, tar, mkdir, base64, chmod) without invoking sudo.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (empty folder, false open_recent, null order/group, default slug/display_name). The extensions variable accepts a list with optional version pinning syntax. No validation blocks are present, but the inputs are straightforward enough that validation is not critical.
Test coverage	4	2	The module includes .tftest.hcl with basic plan assertions (URI format, extension acceptance). TypeScript tests in main.test.ts cover end-to-end behavior including URL generation, extension installation, MCP configuration, and Remote Host download logic. However, the .tftest.hcl tests are minimal (only 2 runs checking basic outputs), while the TypeScript tests carry most of the weight. The business logic coverage in Terraform tests is limited. Half credit.

Overall — 68 / 100

Raw 63 / 92 → round(63 / 92 × 100) = 68

Recalculation:

• Presentation: 12
• IDE Integration: 23
• Credential Hygiene: 20
• Restricted-Environment: 2
• Engineering Quality: 8
• Total: 65 / 92 → 71 / 100

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	23 / 25	20 / 20	2 / 20	8 / 10	71 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, pre-installing extensions, and configuring MCP servers. Each example is clear with sensible defaults.
Visual preview	5	0	README references an icon but does not embed an actual image, GIF, or video showing the module in action.

IDE Integration — 23 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates a coder_app via the vscode-desktop-core wrapper with proper launch behavior using the devin:// protocol. Fully documented with customizable slug and display_name.
Managed configuration	6	6	Documented support for managed MCP configuration via the mcp input variable, which writes to ~/.config/devin/mcp_config.json. Example shows GitHub MCP server configuration with external auth.
Configurable folder or workdir	6	6	The folder variable is documented and demonstrated in examples, allowing the IDE to open in a configured directory.
Pre-installed extensions	6	4	The extensions variable is documented with an example. However, the blocking behavior (up to 30 minutes) and reuse logic on subsequent starts are mentioned but not prominently documented as user-facing behavior. Partial documentation.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The module does not define sensitive inputs. The MCP example uses data.coder_external_auth.github.access_token, a reference rather than an inline secret.
Non-hardcoded auth path	4	4	README example demonstrates OAuth via coder_external_auth for GitHub MCP server authentication, avoiding raw API keys.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The Devin Remote Host download URL is hardcoded in install-remote-server.sh.tftpl as https://windsurf-stable.codeium.com/api/update/.... No module input variable allows overriding this URL.
Bring-your-own binary	10	0	No documented way to disable download when the tool is pre-installed. The script's early-exit check for an executable CLI is an implementation detail, not a documented bring-your-own-binary mode.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The domains (windsurf-stable.codeium.com, windsurf-stable.codeiumdata.com) are visible only in source code.
Runs without sudo	2	2	Both install-remote-server.sh.tftpl and the MCP configuration script operate entirely with user-space commands (curl/wget, tar, mkdir, base64, chmod) without invoking sudo.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions and sensible defaults. The extensions variable accepts a list with optional version pinning. No validation blocks, but inputs are straightforward.
Test coverage	4	2	.tftest.hcl includes only 2 basic plan assertions. TypeScript tests in main.test.ts provide comprehensive end-to-end coverage (URL generation, extension installation, MCP configuration, Remote Host download). Business logic coverage in Terraform tests is minimal.

Overall — 68 / 100 → 71 / 100

---

Scored against SCORECARD.md on 2026-09-01 with claude-sonnet-4-5.