Windsurf Editor module

[bpmct]

A discussion dedicated to the Windsurf Editor module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 25	20 / 20	N/A	8 / 10	81 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, and configuring MCP servers. Each example is clear with sensible defaults.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Uses coder_app via the vscode-desktop-core module with proper launch behavior through the windsurf:// protocol.
Managed configuration	6	6	Documented MCP configuration support via the mcp input variable, which writes to ~/.codeium/windsurf/mcp_config.json using a coder_script. Example shows GitHub MCP server configuration.
Configurable folder or workdir	6	5	The folder variable is documented with an example showing /home/coder/project. However, the description is minimal ("The folder to open in Windsurf Editor") without explaining behavior when unset or validation guidance. Half point deducted for under-documentation.
Pre-installed extensions	6	0	N/A - Windsurf is a desktop IDE, not a web IDE. This criterion does not apply.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The MCP example uses data.coder_external_auth.github.access_token which is a reference, not an inline secret. No sensitive inputs are defined in the module itself that would need marking. README examples avoid inline secrets.
Non-hardcoded auth path	4	4	README demonstrates OAuth via coder_external_auth resource for GitHub authentication in the MCP example, avoiding raw API keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing; it only creates Coder resources (coder_app via submodule, coder_script). No artifacts to mirror.
Bring-your-own binary	10	N/A	Module downloads nothing; it only creates Coder resources. No binary installation to skip.
Egress transparency	3	N/A	Module downloads nothing; it only creates Coder resources. The windsurf:// URL is a client-side protocol handler, not a server-side download.
Runs without sudo	2	N/A	The only script (windsurf_mcp) creates directories and writes a file with standard shell commands (mkdir, echo, base64, chmod). No sudo invoked. However, since this theme is N/A due to no downloads, this criterion is also excluded.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and sensible defaults. However, mcp lacks validation for JSON format, and folder lacks description of behavior when empty. agent_id description is minimal. No validation blocks present.
Test coverage	4	4	Comprehensive test coverage in main.test.ts with unit tests for URL generation, folder handling, open_recent behavior, and end-to-end MCP file writing in a container. Tests cover business logic and runtime behavior.

Overall — 81 / 100

Raw 58 / 72 → round(58 / 72 × 100) = 81

---

Scored against SCORECARD.md on 2026-08-27 with claude-sonnet-4-5.

[matifali]

BTW, Windsurf Editor is now called Devin Desktop. May we also check for any upstream changes or deprecations?
https://devin.ai/blog/windsurf-is-now-devin-desktop/
cc: @bpmct