JetBrains Toolbox module

[bpmct]

A discussion dedicated to the JetBrains Toolbox module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	13 / 19	20 / 20	N/A	10 / 10	91 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents all major modes with dedicated examples: Pre-configured Mode (default = ["PY","IU"]), User Choice with Limited Options (options), EAP channel, Pinned/Air-Gapped (ide_config), Single IDE, and Custom Tooltip. Each example uses sensible defaults and is clearly labeled.
Visual preview	5	5	README embeds ; image verified to exist (40.5 KB).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in the module. All variables (agent_id, folder, default, options, ide_config, etc.) are non-secret configuration values. The $SESSION_TOKEN in the app URL is a Coder runtime substitution, not a Terraform input. No inline secrets in any README example.
Non-hardcoded auth path	4	4	Auth is handled entirely by Coder's built-in $SESSION_TOKEN mechanism embedded in the jetbrains:// URL. No raw API keys, tokens, or credentials are pasted into templates.

Restricted-Environment Readiness — N/A

All four criteria are N/A: the module downloads and installs nothing of its own. It creates coder_app resources (dashboard buttons) and a coder_parameter; the actual JetBrains IDEs are installed and managed by the user's locally-installed JetBrains Toolbox. No scripts are executed.

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module installs/downloads no tool. releases_base_link overrides the version-metadata API URL, not a tool download URL.
Bring-your-own binary	10	N/A	No binary is downloaded or installed by the module.
Egress transparency	3	N/A	No tool download or install occurs; the only external call is optional version-metadata lookup (bypassable via ide_config).
Runs without sudo	2	N/A	Module contains no scripts; it is pure Terraform resource definitions.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 14 variables have clear descriptions and sensible defaults. folder validates full-path regex; major_version validates YYYY.N or latest; channel validates `release
Test coverage	4	4	22 test runs in .tftest.hcl covering: parameter-vs-app creation logic, URL structure (scheme, folder, product code, build number, agent name), ordering, tooltip defaults/overrides, EAP channel, specific major version, ide_config single/multi/partial, output schema validation, and four expect_failures validation-rejection tests. Comprehensive business-logic coverage.

IDE Integration — 13 / 19

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resources created with external = true, proper jetbrains://gateway/coder URL including workspace, owner, folder, access URL, session token, product code, and build number. Slugs, display names, and icons are set. README shows the dropdown in action.
Managed configuration	6	0	No support for managed IDE settings, settings.xml, idea.properties, or any other IDE configuration injection. The ide_config variable controls build numbers and display metadata only, not IDE runtime settings.
Configurable folder or workdir	6	6	folder variable is documented ("The directory to open in the IDE"), validated (full-path regex), and passed into the app URL as &folder=. All README examples demonstrate its use.
Pre-installed extensions	6	N/A	JetBrains IDEs are desktop applications launched via Toolbox, not web IDEs. Criterion does not apply.

Overall — 91 / 100

Raw 60 / 66 → round(60 / 66 × 100) = 91

---

Scored against SCORECARD.md on 2026-10-05 with solstice-1.