KasmVNC module

[bpmct]

A discussion dedicated to the KasmVNC module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	0 / 20	10 / 10	63 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides a clear example with sensible defaults (desktop_environment, subdomain). The module has multiple configuration options (port, kasm_version, share, order, group) and the example demonstrates the primary mode.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference exists.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The module does not handle API keys, passwords, or other secrets. The VNC password is generated internally and not exposed as an input.
Non-hardcoded auth path	4	4	No authentication credentials are required. The module explicitly disables authentication (-disableBasicAuth) and relies on Coder's session token/tunnel for security, which is a proper non-hardcoded auth path.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable exists to override the download URL. The base_url is hardcoded to "https://github.com/kasmtech/KasmVNC/releases/download/v${KASM_VERSION}" in run.sh. The kasm_version variable only controls the version number, not the source URL.
Bring-your-own binary	10	0	No documented way to skip installation when KasmVNC is pre-installed. While the script checks if kasmvncserver is installed (check_installed function), it only skips the install step but still runs configuration. There is no module input to disable the entire installation process.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The GitHub download URL is only visible in the source code (run.sh), not documented in the README.
Runs without sudo	2	0	The script requires sudo for core functionality. While there is a fallback path that writes to $HOME/.vnc/kasmvnc.yaml when sudo is unavailable, the installation functions (install_deb, install_rpm, install_alpine) all require sudo and will fail without it. The script explicitly checks for "sudo NOPASSWD access required!" and exits if unavailable during installation.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults are provided (port=6800, kasm_version="1.4.0", subdomain=true, share="owner"). Validation blocks exist for desktop_environment (checking against allowed values) and share (checking against owner/authenticated/public).
Test coverage	4	4	Clear testing story with main.test.ts covering business logic (testing all allowed desktop environments). The test uses testRequiredVariables to verify required inputs and iterates through all allowedDesktopEnvs to ensure each works. TypeScript tests cover the module's configuration variations.

Overall — 63 / 100

Raw 42 / 67 → round(42 / 67 × 100) = 63

Note: This is a Utility module (VNC desktop access tool, not an Agent or IDE). Normalized score: round(42 / 67 × 100) = 63.

Correction: Re-evaluating track assignment. KasmVNC provides desktop environment access through a web interface. This is neither an AI coding agent nor a traditional IDE/editor. However, examining the rubric's IDE track definition more carefully: "IDE track" covers "editors/IDEs users open." KasmVNC provides desktop access which could include IDEs, but it is fundamentally a VNC server providing full desktop environment access, not specifically an IDE. This is a Utility module.

Final calculation for Utility track:

• Universal criteria: 42 / 67
• Normalized: round(42 / 67 × 100) = 63

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.