JetBrains Gateway module

[bpmct]

A discussion dedicated to the JetBrains Gateway module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	24 / 25	20 / 20	8 / 20	8 / 10	85 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default usage, specific IDE selection, latest vs fixed versions, EAP channel, custom base links. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and JetBrains Gateway, explains it adds a one-click button to the dashboard, and references the Coder Toolbox alternative with documentation link showing where Gateway fits in the flow.
Visual preview	5	5	README includes  showing the module in action.

IDE Integration — 24 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper external launch behavior via jetbrains-gateway:// URL scheme.
Managed configuration	6	6	Documented support for managed IDE selection via coder_parameter, version control via jetbrains_ide_versions, channel selection, and custom download/release links.
Configurable folder or workdir	6	6	folder variable with validation and documented in all examples, opens configured directory in IDE.
Pre-installed extensions	6	5	Not applicable (Gateway is not a web IDE; it's a launcher for native JetBrains IDEs). Scoring as 5/6 to reflect this is inherently N/A but rubric requires IDE track scoring. Actually, re-reading rubric: this criterion is marked "web IDEs only" so should be excluded. Adjusting score.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module. Uses $SESSION_TOKEN placeholder in URL which is handled by Coder runtime, not exposed as a module input. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's native $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 8 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	5	releases_base_link and download_base_link variables allow overriding JetBrains endpoints. However, these only affect metadata lookup and the URL passed to Gateway client; the module itself downloads nothing. The "Custom base link" example documents this for offline IDEA mode. Partial credit as it addresses the spirit but doesn't control actual downloads performed by the Gateway client.
Bring-your-own binary	5	0	No documented way to disable or skip IDE installation. The module always generates Gateway URLs with download links; there's no option to omit them when IDEs are pre-installed.
Egress transparency	3	1.5	Endpoints are inferable from code (data.services.jetbrains.com, download.jetbrains.com) and mentioned in the custom base link example, but no dedicated README section enumerates external endpoints or provides air-gapped guidance. Half credit per rubric.
Runs without sudo	2	1.5	No install scripts in this module; it only generates URLs for the Gateway client. The module itself runs without sudo. However, the Gateway client and IDE installation happen client-side outside module control. Scoring as half since module code is sudo-free but the complete flow involves external components. Actually, re-reading: module has no scripts at all, so this should be N/A per rubric. Adjusting.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Most inputs have descriptions and validation (arch, folder, jetbrains_ides, channel, URLs). However, several lack descriptions (releases_base_link, download_base_link have empty description strings). Defaults are sensible. Half credit lost for incomplete descriptions.
Test coverage	4	4	Clear testing story with TypeScript tests in main.test.ts covering required variables, default values, IDE selection, agent name handling. Tests verify URL generation and coder_app resource creation.

Overall — 85 / 100

Pre-installed extensions criterion excluded (web IDEs only, N/A for Gateway launcher).
Runs without sudo excluded (module has no scripts).
Adjusted denominator: 100 - 6 (extensions) - 2 (sudo) = 92
Raw: 25 + 18 + 20 + 8 + 8 = 79
Normalized: round(79 / 92 × 100) = 86

Wait, recalculating IDE track: Dashboard entry point (7) + Managed configuration (6) + Configurable folder (6) = 19 out of 19 applicable (extensions N/A). That's 19/19 = full marks for applicable criteria, but track is scored out of 25 total. So: 19 earned, 6 N/A, denominator becomes 19, normalized to 25: round(19/19 × 25) = 25. But rubric says normalize final score to 100, not individual tracks.

Re-reading rubric more carefully: "If applicable" criteria are "excluded from the denominator and the final score is normalized to 100." This applies to the overall score calculation, not track-by-track.

Recalculating:

• Presentation: 25/25
• IDE track: 7 + 6 + 6 = 19, with 6 N/A for extensions = 19/19 applicable
• Credential: 20/20
• Restricted-Env: 5 + 0 + 1.5 + N/A(2) = 6.5/18 applicable
• Engineering: 4 + 4 = 8/10

Total applicable points: 25 + 19 + 20 + 18 + 10 = 92
Total earned: 25 + 19 + 20 + 6.5 + 8 = 78.5
Normalized: round(78.5 / 92 × 100) = round(85.33) = 85

For display, IDE track shows as 19/25 (since track total is always 25), Restricted shows as 6.5/20.

Actually, re-reading the Runs without sudo criterion again: "Runs without sudo goes N/A only for modules with no scripts at all." This module has no scripts (no startup_script, no install scripts), only Terraform resources. So it should be N/A.

Final recalculation with sudo N/A:

• Restricted-Env applicable: 10 + 5 + 3 = 18 (sudo excluded)
• Restricted-Env earned: 5 + 0 + 1.5 = 6.5

Total applicable: 25 + 19 + 20 + 18 + 10 = 92
Total earned: 25 + 19 + 20 + 6.5 + 8 = 78.5
Normalized: round(78.5 / 92 × 100) = 85

---

Scored against SCORECARD.md on 2026-07-20 with claude-sonnet-4-5.