Windsurf Editor module

[bpmct]

A discussion dedicated to the Windsurf Editor module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 25	20 / 20	N/A	8 / 10	74 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, and configuring MCP servers. Each example is complete and demonstrates sensible defaults.
Coder-context framing	8	1	README mentions "Add a button to open any workspace" and references the Coder Remote VS Code Extension, but does not explain what Windsurf is, how it relates to Coder, or where Coder fits in the user flow. Minimal context for someone unfamiliar with Windsurf.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module uses coder_app via the vscode-desktop-core submodule with proper launch behavior (windsurf:// protocol URL).
Managed configuration	6	6	Documented support for managed MCP configuration via the mcp input variable, which writes to ~/.codeium/windsurf/mcp_config.json. README includes a complete example with GitHub MCP server.
Configurable folder or workdir	6	5	The folder variable is documented with an example showing opening in a specific directory. However, the variable description is minimal ("The folder to open in Windsurf Editor") and could better explain behavior when unset. Half point deducted for under-documentation.
Pre-installed extensions	6	0	N/A - Windsurf is a desktop IDE, not a web IDE. This criterion does not apply.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The mcp variable is not marked sensitive, but it appropriately contains configuration rather than raw secrets. The README example demonstrates proper credential hygiene by using data.coder_external_auth.github.access_token rather than inline secrets. No sensitive inputs exist in the module.
Non-hardcoded auth path	4	4	README example shows OAuth via coder_external_auth resource for GitHub authentication, avoiding raw API keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only generates a windsurf:// protocol URL and optionally writes a config file. No artifacts to mirror.
Bring-your-own binary	5	N/A	Module does not install any binary; Windsurf is assumed to be installed on the client machine.
Egress transparency	3	N/A	Module makes no network calls itself; it generates URLs for the client-side Windsurf application to use.
Runs without sudo	2	N/A	The coder_script resource writes to $HOME/.codeium/windsurf/mcp_config.json and uses chmod 600, both of which work without sudo as an unprivileged user. However, since all download-related criteria are N/A, this entire theme is N/A per normalization rules.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and sensible defaults. However, descriptions are terse (e.g., folder just says "The folder to open"). No validation blocks present where they could be useful (e.g., validating mcp is valid JSON).
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts cover URL generation with various input combinations, MCP file writing, and file permissions. Tests verify business logic end-to-end.

Overall — 74 / 100

Raw 59 / 80 → round(59 / 80 × 100) = 74

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.

[matifali]

BTW, Windsurf Editor is now called Devin Desktop. May we also check for any upstream changes or deprecations?
https://devin.ai/blog/windsurf-is-now-devin-desktop/
cc: @bpmct