JetBrains Gateway module

[bpmct]

A discussion dedicated to the JetBrains Gateway module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 25	20 / 20	0 / 20	8 / 10	63 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default usage, specific IDE selection, latest vs fixed versions, EAP channel, custom base links. Each example is complete and sensible.
Visual preview	5	0	README references ../.images/jetbrains-gateway.png but the file was NOT FOUND during verification. No actual image, GIF, or video is present.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper external launch behavior via jetbrains-gateway:// URL scheme.
Managed configuration	6	6	Documented support for managed IDE selection via coder_parameter with mutable IDE choice, version control via jetbrains_ide_versions and latest variables, and channel selection (release/eap).
Configurable folder or workdir	6	5	folder variable is required and validated, passed to Gateway URL. However, no example demonstrates different folder configurations or explains folder selection strategy—documentation is minimal beyond the variable itself. Half credit deducted for under-documentation.
Pre-installed extensions	6	0	Not applicable to JetBrains Gateway (client-side IDE, not web-based). No extension pre-installation mechanism exists or is documented.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secrets are inputs to this module. The $SESSION_TOKEN in the URL is a Coder-provided runtime token, not a user-supplied input. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's native $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	releases_base_link and download_base_link variables exist and are documented in the "Custom base link" example. However, these control metadata lookup and the URL passed to Gateway—the module itself downloads nothing. The actual IDE download is performed by JetBrains Gateway client on the user's machine, outside this module's control. These variables do not override a download performed by the module. Score 0 per calibration anchor: no module variable replaces the tool's download URL in an install path executed by this module.
Bring-your-own binary	10	0	No mechanism to skip or disable IDE version resolution. The module always constructs a Gateway URL with IDE metadata. No documented way to use pre-installed IDEs or bypass version specification.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The data.services.jetbrains.com and download.jetbrains.com endpoints are visible only in variable defaults and code. Mentions are scattered, not consolidated in a network/offline/air-gapped section.
Runs without sudo	2	0	Not applicable—module contains no install or runtime scripts. It only creates Terraform resources (coder_app, coder_parameter, data sources). However, per rubric, N/A applies only when no scripts exist. Since this module has no scripts at all, this should be N/A, but the rubric states "applies whenever the module executes any script." Re-reading: "goes N/A only for modules with no scripts at all." This module has no scripts, so N/A is appropriate. Revising score to N/A.

Revised Restricted-Environment Readiness: Runs without sudo is N/A (no scripts). Denominator becomes 18. Raw score 0 / 18.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	5	Most inputs have clear descriptions and validation (arch, folder, jetbrains_ides, channel, releases_base_link, download_base_link). However, releases_base_link and download_base_link have empty description strings (description = ""), reducing clarity. Defaults are sensible. Half point deducted for missing descriptions.
Test coverage	4	3	TypeScript tests in main.test.ts cover required variables, default values, IDE selection, agent name handling. No .tftest.hcl file present. Tests focus on output validation rather than end-to-end Gateway launch behavior. Half credit deducted for missing Terraform native tests and limited end-to-end coverage.

Overall — 63 / 100

Raw 58 / 92 → round(58 / 92 × 100) = 63

Raw: 12 + 18 + 20 + 0 + 8 = 58 / 92 before N/A adjustment.

With Runs without sudo N/A: denominator becomes 92 - 2 = 90.

Normalized: round(58 / 90 × 100) = round(64.44) = 64 / 100

Correction: Re-calculating with proper N/A handling:

• Presentation: 12 / 17
• IDE Integration: 18 / 25
• Credential Hygiene: 20 / 20
• Restricted-Environment: 0 / 18 (Runs without sudo N/A, so max is 18 not 20)
• Engineering Quality: 8 / 10

Total: 58 / 90 → round(58 / 90 × 100) = 64 / 100

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 25	20 / 20	0 / 18	8 / 10	64 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default usage, specific IDE selection, latest vs fixed versions, EAP channel, custom base links. Each example is complete and sensible.
Visual preview	5	0	README references ../.images/jetbrains-gateway.png but the file was NOT FOUND during verification. No actual image, GIF, or video is present.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper external launch behavior via jetbrains-gateway:// URL scheme.
Managed configuration	6	6	Documented support for managed IDE selection via coder_parameter with mutable IDE choice, version control via jetbrains_ide_versions and latest variables, and channel selection (release/eap).
Configurable folder or workdir	6	5	folder variable is required and validated, passed to Gateway URL. However, no example demonstrates different folder configurations or explains folder selection strategy—documentation is minimal beyond the variable itself.
Pre-installed extensions	6	0	Not applicable to JetBrains Gateway (client-side IDE, not web-based). No extension pre-installation mechanism exists or is documented.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secrets are inputs to this module. The $SESSION_TOKEN in the URL is a Coder-provided runtime token, not a user-supplied input. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's native $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 0 / 18

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	releases_base_link and download_base_link variables exist but control URLs passed to the Gateway client, not downloads performed by this module. The module itself downloads nothing—it only constructs metadata URLs. Per calibration anchor, no module variable overrides a download URL in an install path executed by this module.
Bring-your-own binary	10	0	No mechanism to skip or disable IDE version resolution. The module always constructs a Gateway URL with IDE metadata. No documented way to use pre-installed IDEs or bypass version specification.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The data.services.jetbrains.com and download.jetbrains.com endpoints are visible only in variable defaults and code, not consolidated in a network/offline/air-gapped section.
Runs without sudo	2	N/A	Module contains no install or runtime scripts—only Terraform resources. Per rubric, N/A applies for modules with no scripts at all.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	5	Most inputs have clear descriptions and validation (arch, folder, jetbrains_ides, channel). However, releases_base_link and download_base_link have empty description strings (description = ""). Defaults are sensible.
Test coverage	4	3	TypeScript tests in main.test.ts cover required variables, default values, IDE selection, agent name handling. No .tftest.hcl file present. Tests focus on output validation rather than end-to-end Gateway launch behavior.

Overall — 63 / 100

---

Scored against SCORECARD.md on 2026-08-26 with claude-sonnet-4-5.