JetBrains Gateway module

[bpmct]

A discussion dedicated to the JetBrains Gateway module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	18 / 25	20 / 20	8 / 20	8 / 10	79 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default usage, specific IDE selection, latest vs fixed versions, EAP channel, custom base links. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and JetBrains Gateway, explains the module adds a one-click button to the dashboard, and shows where Coder fits (workspace access via Gateway protocol).
Visual preview	5	5	README includes  showing the module in action.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper external launch behavior via jetbrains-gateway:// protocol URL.
Managed configuration	6	6	Documented support for managed IDE selection via coder_parameter, version pinning via jetbrains_ide_versions, channel selection, and custom download/release links.
Configurable folder or workdir	6	5	folder variable with validation is documented and used in the gateway URL. However, no example shows varying the folder across different use cases; all examples use the same placeholder path.
Pre-installed extensions	6	0	N/A - Gateway is a launcher/protocol handler, not a web IDE.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The $SESSION_TOKEN in the URL is a Coder-provided runtime variable, not a user-supplied secret. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's native $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 8 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	5	releases_base_link and download_base_link variables allow overriding JetBrains endpoints. However, these only affect the URL embedded in the gateway protocol link; the module itself downloads nothing. The actual IDE download happens client-side via Gateway. Custom base link example documents this for offline IDEA mode. Partial credit for enabling mirror support in the protocol URL.
Bring-your-own binary	5	0	No documented way to disable or skip IDE specification. The module always constructs a gateway URL with download links.
Egress transparency	3	1.5	The custom base link example mentions JetBrains offline mode and shows the two base link variables, implicitly revealing data.services.jetbrains.com and download.jetbrains.com as endpoints. However, there is no dedicated section enumerating endpoints for restricted environments. At most half.
Runs without sudo	2	2	N/A - Module contains no install or runtime scripts. It only creates Terraform resources (coder_app, coder_parameter, data sources).

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Most inputs have descriptions and validation (arch, folder, channel, jetbrains_ides with multiple validations, base links). However, releases_base_link and download_base_link have empty description strings. Defaults are sensible.
Test coverage	4	4	Clear testing story: .test.ts covers business logic (default values, IDE selection, agent parameter handling, URL construction). Tests verify outputs and resource attributes.

Overall — 79 / 100

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.