KasmVNC module

[bpmct]

A discussion dedicated to the KasmVNC module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	2 / 20	10 / 10	60 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Single clear example with sensible defaults (desktop_environment, subdomain). Module has limited configuration surface.
Coder-context framing	8	1	Mentions "via the dashboard" and names KasmVNC, but does not explain what KasmVNC adds on top of Coder or show where Coder fits in the flow. No explanation of the VNC-over-Coder-tunnel architecture.
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist. KasmVNC password is hardcoded in run.sh as "password" but explicitly documented as unused since server runs without auth, protected by Coder session token. No README examples with inline secrets.
Non-hardcoded auth path	4	4	Uses Coder session token / tunnel for auth, avoiding raw keys entirely. Script comment explicitly states password is not used.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the GitHub download URL. The base_url is hardcoded to "https://github.com/kasmtech/KasmVNC/releases/download/v${KASM_VERSION}" in run.sh. Version can be changed via kasm_version variable but the domain/path cannot.
Bring-your-own binary	5	0	No documented way to skip installation when KasmVNC is pre-installed. The check_installed function detects existing installation but still proceeds with configuration steps; no variable to disable the entire install block.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. GitHub download URL is only visible in source code.
Runs without sudo	2	2	Script checks for sudo and degrades gracefully: "if command -v sudo &> /dev/null && sudo -n true 2> /dev/null; then ... else ... SUDO="" ... echo 'WARNING: Sudo access not available, using user config dir!'" Config writes to user home when sudo unavailable. Install requires sudo but runtime works without it. Core VNC server functionality works unprivileged.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults (port 6800, kasm_version 1.4.0, subdomain true, share owner). Validation on desktop_environment and share variables.
Test coverage	4	4	main.test.ts covers business logic (required variables, all desktop environments). Clear testing story with testRequiredVariables and iteration over allowedDesktopEnvs.

Overall — 60 / 100

Raw 45 / 75 → round(45 / 75 × 100) = 60

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.