Windsurf Editor module

[bpmct]

A discussion dedicated to the Windsurf Editor module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 25	20 / 20	N/A	8 / 10	74 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, and configuring MCP servers. Each example is complete and demonstrates sensible defaults.
Coder-context framing	8	1	README mentions "Add a button to open any workspace" and references the Coder Remote VS Code Extension, but does not explain what Windsurf is, how it relates to Coder, or where Coder fits in the user flow. Minimal context for someone unfamiliar with Windsurf.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module uses coder_app via the vscode-desktop-core submodule with proper launch behavior through the windsurf:// protocol.
Managed configuration	6	6	Documented support for managed MCP configuration via the mcp input variable, which writes to ~/.codeium/windsurf/mcp_config.json. README includes a complete example with GitHub MCP server setup.
Configurable folder or workdir	6	5	The folder variable is documented with an example showing how to open a specific directory. However, the variable description is minimal ("The folder to open in Windsurf Editor") and doesn't explain behavior when unset or interaction with open_recent. Half point deducted for under-documentation.
Pre-installed extensions	6	0	N/A - Windsurf is a desktop IDE, not a web IDE. This criterion does not apply.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The MCP example uses data.coder_external_auth.github.access_token which is a secure reference pattern. No inline secrets in examples. The mcp variable itself is not marked sensitive, but it accepts JSON that may contain tokens; however, the example demonstrates the proper external auth pattern, avoiding inline secrets entirely.
Non-hardcoded auth path	4	4	README demonstrates OAuth via coder_external_auth resource for GitHub authentication in the MCP example, avoiding raw key pasting.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module does not download or install any tools. It only configures a coder_app and optionally writes a config file. No artifacts to mirror.
Bring-your-own binary	5	N/A	Module does not install binaries. Windsurf is expected to be installed on the client machine, not in the workspace.
Egress transparency	3	N/A	Module makes no external network calls. The windsurf:// URL is opened client-side, and the MCP configuration is user-provided.
Runs without sudo	2	N/A	The only script (windsurf_mcp) creates a directory and writes a file to $HOME, never invoking sudo. Full credit would apply, but since the entire theme is N/A, this is excluded from scoring.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and sensible defaults. However, descriptions are brief (e.g., folder lacks detail about behavior). No validation blocks present where they could be useful (e.g., validating mcp is valid JSON).
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts cover URL generation with various input combinations, MCP file writing, and container-based validation. Tests verify business logic thoroughly.

Overall — 74 / 100

Raw 59 / 80 → round(59 / 80 × 100) = 74

(Restricted-Environment Readiness excluded as N/A; normalized from 75-point denominator)

---

Scored against SCORECARD.md on 2026-07-20 with claude-sonnet-4-5.

[matifali]

BTW, Windsurf Editor is now called Devin Desktop. May we also check for any upstream changes or deprecations?
https://devin.ai/blog/windsurf-is-now-devin-desktop/
cc: @bpmct