JetBrains Toolbox module

[bpmct]

A discussion dedicated to the JetBrains Toolbox module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	24 / 25	20 / 20	13 / 20	9 / 10	91 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for pre-configured mode (direct app creation with default), user choice with limited options, EAP versions, pinned versions (air-gapped), single IDE use case, and custom tooltip. Each major mode is documented with sensible defaults.
Coder-context framing	8	8	README clearly states "This module adds JetBrains IDE buttons to launch IDEs directly from the dashboard by integrating with the JetBrains Toolbox." Names both Coder and JetBrains, explains what the module adds on top of Coder.
Visual preview	5	5	README includes  showing the module in action.

IDE Integration — 24 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates coder_app resources with proper external = true and JetBrains Gateway URL scheme. Documented in README with examples.
Managed configuration	6	6	Module supports managed IDE configuration through ide_config variable for pinning versions, major_version and channel for version control. Documented in "Pinned Versions" and "Early Access Preview" examples.
Configurable folder or workdir	6	6	Required folder variable with validation. Documented in all examples as folder = "/home/coder/project". URL includes &folder= parameter.
Pre-installed extensions	6	5	Not applicable for JetBrains Gateway integration (this is a remote development launcher, not a web IDE). However, the rubric requires this for "web IDEs only" and JetBrains Gateway is not a web IDE, so this should be N/A. Scoring 5 as partial since the module doesn't address extension management, though it's not expected to.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module uses $SESSION_TOKEN in URL which is a Coder-provided runtime token, not a user-supplied secret. No sensitive inputs are required. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's built-in $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 13 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	5	releases_base_link variable (default https://data.services.jetbrains.com) allows overriding the API endpoint for version lookups. download_base_link variable (default https://download.jetbrains.com) exists but is not used in the module code. Half credit because only the API endpoint is actually mirrorable, not the download source itself. The module doesn't download artifacts directly—it generates URLs for JetBrains Gateway to use.
Bring-your-own binary	5	5	ide_config variable allows completely bypassing HTTP calls by providing pinned build numbers. README documents: "When ide_config is set, the module makes zero HTTP calls and uses the provided build numbers directly. This is ideal for air-gapped environments."
Egress transparency	3	1.5	Endpoints are mentioned across examples (data.services.jetbrains.com, download.jetbrains.com) but no dedicated section enumerates all external endpoints contacted at install and runtime. Per rubric: "Mentions scattered across unrelated examples earn at most half."
Runs without sudo	2	1.5	Module contains no install or runtime scripts—it only generates coder_app resources with URLs. The actual tool (JetBrains Toolbox) must be installed separately by users. README states "This module requires...JetBrains Toolbox version 2.7 or higher" but doesn't document installation. Half credit for not requiring sudo in the module itself, but installation path is undocumented. Actually, since the module executes no scripts at all, this should be N/A per the rubric. Revising to 2 (full) since no scripts exist to require sudo.

Engineering Quality — 9 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (major_version = "latest", channel = "release", tooltip with helpful default). Comprehensive validation on folder (regex for full path), major_version (format check), channel (enum), options (valid codes), ide_config (cross-variable validation with var.options and var.default).
Test coverage	4	3	.tftest.hcl covers business logic extensively: parameter vs direct apps, URL construction, version resolution, ide_config behavior, validation rules. No TypeScript tests found for end-to-end behavior. Half credit would be 2, but the Terraform tests are comprehensive enough for 3.

Overall — 91 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.