JetBrains Gateway module

[bpmct]

A discussion dedicated to the JetBrains Gateway module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 25	20 / 20	0 / 20	8 / 10	63 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default usage, selecting specific IDEs, latest vs fixed versions, EAP channel, custom base links. Each has sensible defaults.
Visual preview	5	0	README references ../.images/jetbrains-gateway.png but the file was NOT FOUND per verification output. No actual image, GIF, or video is present.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper external launch behavior via jetbrains-gateway:// URL scheme.
Managed configuration	6	6	Documented support for managed IDE selection via coder_parameter.jetbrains_ide with mutable parameter allowing users to switch IDEs. Version control via jetbrains_ide_versions and latest variables.
Configurable folder or workdir	6	5	folder variable is required and validated, opens configured directory. However, validation error message says "must not start with a ~" but regex actually requires absolute paths starting with /, creating minor documentation-code mismatch. Half point deducted for this inconsistency.
Pre-installed extensions	6	0	N/A - JetBrains Gateway is not a web IDE; it's a launcher for remote development. This criterion does not apply. Scoring 0 as per rubric (not excluded from denominator per track definition).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module. Uses $SESSION_TOKEN placeholder in URL which is handled by Coder runtime, not exposed as a module input. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	releases_base_link and download_base_link variables exist and are documented in the "Custom base link" example. However, these only affect the URL embedded in the jetbrains-gateway:// link passed to the client-side Gateway application. The module itself downloads nothing; Gateway (running on the user's machine) downloads the IDE. Since the module performs no download/install of its own, this should be N/A, but the variables suggest intent to support restricted environments for the client-side download. Scoring 0 because the module doesn't control the actual download process.
Bring-your-own binary	10	0	No documented way to disable download or use pre-installed IDEs. The module always generates a download link in the Gateway URL.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The releases_base_link and download_base_link defaults are visible in variable descriptions but scattered, not in a dedicated network/offline section.
Runs without sudo	2	0	No scripts present in the module (only Terraform configuration). This criterion should be N/A per rubric ("goes N/A only for modules with no scripts at all"), but per strict rubric interpretation for IDE track, scoring as written. Actually, re-reading: no scripts means N/A. However, rubric says "excluded when concern does not exist by construction" - no scripts means no sudo concern. Changing to N/A would require denominator adjustment. Per rubric: "Score 0 only when a concern exists and the module lacks the capability." No scripts = concern doesn't exist = should be N/A. But rubric also says don't use N/A for concerns that exist but are unaddressed. Since there are no scripts, the concern doesn't exist. However, the rubric's N/A guidance for this criterion is explicit: "goes N/A only for modules with no scripts at all." This module has no scripts, so this should be N/A. But the scoring instructions say Utility modules skip track section and normalize, while IDE modules use full denominator. Re-reading carefully: this is IDE track, denominator is 92. The Restricted-Environment criteria are marked "if applicable" in the rubric. Since this module downloads nothing of its own (only generates URLs for client-side Gateway), Mirrorable/BYOB/Egress should be N/A. Runs without sudo applies "whenever the module executes any script" - no scripts here, so N/A. Recalculating with all Restricted-Environment as N/A: denominator becomes 72, raw score 58, normalized = round(58/72*100) = 81. But let me verify the download claim: the module uses data.http to fetch version info when latest = true. That IS a download/external call. So Egress transparency applies. Mirrorable would need a variable to override data.http URL - releases_base_link does exactly that. So Mirrorable = 5, but needs documentation in dedicated section for Egress. BYOB would be ability to skip the data.http call - latest = false does that. So BYOB = 10. Egress needs dedicated section = 0 (at most 1.5 for scattered mentions). Runs without sudo = N/A (no scripts). New calculation: Restricted = 15/18, denominator = 90, raw = 73, normalized = 81. Let me score this properly.

Recalculating Restricted-Environment Readiness:

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	releases_base_link variable (default https://data.services.jetbrains.com) overrides the URL for version metadata fetched via data.http. download_base_link overrides IDE download URLs embedded in the Gateway link. Both documented in "Custom base link" example.
Bring-your-own binary	10	10	Setting latest = false (the default) disables the data.http version fetch entirely, using only the hardcoded jetbrains_ide_versions map. Documented in "Use fixed versions" example.
Egress transparency	3	0	No dedicated README section. Endpoints are inferable from variable defaults and examples but not enumerated in a network/offline/air-gapped section.
Runs without sudo	2	N/A	No scripts in the module. Only Terraform configuration. Per rubric: "goes N/A only for modules with no scripts at all."

Corrected Restricted-Environment: 15 / 18 (2 pts excluded)

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	5	Most inputs have clear descriptions and validation. arch, folder, jetbrains_ides, channel, releases_base_link, download_base_link all validated. However, releases_base_link and download_base_link have empty description strings (""). Deducting 1 point for missing descriptions on two variables.
Test coverage	4	3	TypeScript tests in main.test.ts cover basic functionality (default values, IDE selection, agent name handling). No .tftest.hcl files present. Tests verify outputs but don't cover all configuration modes (e.g., latest = true, custom base links, different architectures). Half credit deducted for incomplete coverage.

Overall — 63 / 100

Raw 58 / 92 → round(58 / 92 × 100) = 63

Correction: Let me recalculate the raw total:

• Presentation: 12
• IDE Integration: 18
• Credential Hygiene: 20
• Restricted-Environment: 15 (out of 18 applicable)
• Engineering Quality: 8

Raw total: 12 + 18 + 20 + 15 + 8 = 73
Denominator: 92 - 2 (N/A for sudo) = 90
Normalized: round(73 / 90 × 100) = 81

Final corrected scorecard:

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 25	20 / 20	15 / 18	8 / 10	81 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default usage, selecting specific IDEs, latest vs fixed versions, EAP channel, custom base links. Each has sensible defaults.
Visual preview	5	0	README references ../.images/jetbrains-gateway.png but the file was NOT FOUND per verification output. No actual image, GIF, or video is present.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper external launch behavior via jetbrains-gateway:// URL scheme.
Managed configuration	6	6	Documented support for managed IDE selection via coder_parameter.jetbrains_ide with mutable parameter allowing users to switch IDEs. Version control via jetbrains_ide_versions and latest variables.
Configurable folder or workdir	6	5	folder variable is required and validated, opens configured directory. However, validation error message says "must not start with a ~" but regex ^(?:/[^/]+)+/?$ actually requires absolute paths starting with /, creating minor documentation-code mismatch. Half point deducted.
Pre-installed extensions	6	0	N/A - JetBrains Gateway is not a web IDE; it's a launcher for remote development. This criterion does not apply to Gateway.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module. Uses $SESSION_TOKEN placeholder in URL which is handled by Coder runtime, not exposed as a module input. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 15 / 18

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	releases_base_link variable (default https://data.services.jetbrains.com) overrides the URL for version metadata fetched via data.http. download_base_link overrides IDE download URLs embedded in the Gateway link. Both documented in "Custom base link" example.
Bring-your-own binary	10	10	Setting latest = false (the default) disables the data.http version fetch entirely, using only the hardcoded jetbrains_ide_versions map. Documented in "Use fixed versions" example.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are inferable from variable defaults and examples but not enumerated in a network/offline/air-gapped section.
Runs without sudo	2	N/A	No scripts in the module. Only Terraform configuration. Per rubric: "goes N/A only for modules with no scripts at all."

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	5	Most inputs have clear descriptions and validation. arch, folder, jetbrains_ides, channel, releases_base_link, download_base_link all validated. However, releases_base_link and download_base_link have empty description strings. Deducting 1 point.
Test coverage	4	3	TypeScript tests in main.test.ts cover basic functionality (default values, IDE selection, agent name handling). No .tftest.hcl files present. Tests verify outputs but don't cover all configuration modes (e.g., latest = true, custom base links, different architectures). Half credit deducted.

Overall — 63 / 100

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.