JetBrains Toolbox module

[bpmct]

A discussion dedicated to the JetBrains Toolbox module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	22 / 25	20 / 20	8 / 20	9 / 10	83 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides comprehensive examples for all major modes: pre-configured (direct app creation with default), user choice with limited options, EAP versions, pinned versions (air-gapped), single IDE, custom tooltip, and accessing IDE metadata. Each example includes sensible defaults and clear use-case descriptions.
Visual preview	5	5	README includes ../../.images/jetbrains-dropdown.png showing the module in action (verified to exist, 40.5 KB).

IDE Integration — 22 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates coder_app resources with proper external = true and JetBrains Gateway URL scheme (jetbrains://gateway/coder). Documented in multiple examples.
Managed configuration	6	6	Module supports managed IDE configuration through ide_config variable allowing pinned versions, custom names, and icons. Documented in "Pinned Versions (Air-Gapped / Cached)" example and variable description.
Configurable folder or workdir	6	6	folder variable is required and documented, with validation ensuring proper path format. URL construction includes &folder=${var.folder}. Examples show usage like /home/coder/project and /workspace/project.
Pre-installed extensions	6	3	Not applicable for JetBrains Gateway integration (this is a remote development launcher, not a web IDE). However, the module does not document any mechanism for pre-installing JetBrains plugins or extensions in the remote workspace. Half credit for partial support through version pinning but no extension management.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module uses $SESSION_TOKEN in URL construction (runtime token substitution by Coder). No sensitive inputs are defined in the module. README examples avoid inline secrets entirely.
Non-hardcoded auth path	4	4	Authentication uses Coder's session token mechanism ($SESSION_TOKEN) which is substituted at runtime, avoiding raw key exposure. Documented in URL construction.

Restricted-Environment Readiness — 8 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	2.5	releases_base_link and download_base_link variables exist and are documented. However, download_base_link appears unused in the module code (only releases_base_link is used in HTTP data source). releases_base_link allows mirroring the version API endpoint but not the actual IDE downloads (which are handled by JetBrains Toolbox client-side). Half credit for partial mirroring capability.
Bring-your-own binary	10	5	ide_config variable allows skipping HTTP calls and using pinned build numbers, documented as "ideal for air-gapped environments." However, this doesn't skip the IDE download itself—that's still performed by the JetBrains Toolbox client when the user clicks the app. The module only skips version lookup. Half credit for partial offline support.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are scattered across examples (data.services.jetbrains.com, download.jetbrains.com) but not consolidated. The "Pinned Versions" example mentions "zero HTTP calls" but doesn't list what endpoints are contacted in non-pinned mode.
Runs without sudo	2	0.5	Module contains no install scripts of its own—it only creates Coder resources (apps/parameters). However, the README warns "JetBrains recommends a minimum of 4 CPU cores and 8GB of RAM" and links to prerequisites, implying the JetBrains Toolbox client must be installed separately. The module doesn't document whether that installation requires sudo. Half credit for module code being sudo-free, but unclear external dependency story.

Engineering Quality — 9 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Validation rules enforce: folder path format, major_version format, channel values, options subset, URL formats, ide_config constraints including cross-variable validation (requires Terraform 1.9+). Sensible defaults provided (tooltip, channel, major_version, options list).
Test coverage	4	3	.tftest.hcl provides 20+ test runs covering: required variables, parameter vs app creation logic, URL construction, agent_name inclusion, order settings, tooltip behavior, channel/version selection, ide_config validation, output schema. Tests cover business logic well. No TypeScript/end-to-end tests visible. Half credit deducted for missing E2E coverage.

Overall — 83 / 100

Raw 76 / 92 → round(76 / 92 × 100) = 83

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.