feat(pool): add Pool CLI module

[ausbru87]

Summary

• add a coder-labs/pool module to install and configure Poolside's Pool CLI
• support direct Poolside credentials/deployment API URLs and generic OpenAI-compatible endpoints
• add Coder AI Gateway support using the workspace owner's session token and the OpenAI-compatible gateway endpoint
• include Terraform tests, docs, and a Poolside icon

Validation

• terraform fmt -check -diff registry/coder-labs/modules/pool
• terraform test -no-color (7 passed)

Implementation plan

1. Model the module structure and script orchestration after the existing Claude Code and Codex modules.
2. Install Pool noninteractively using Poolside's official installer, accepting the EULA and exposing the binary through Coder and shell paths.
3. Expose direct API and OpenAI-compatible endpoint settings through Pool's documented environment variables.
4. For AI Gateway, set POOLSIDE_STANDALONE_BASE_URL to Coder's OpenAI-compatible gateway endpoint and POOLSIDE_API_KEY to the workspace owner's session token; reject conflicting direct endpoint/key inputs at plan time.
5. Document all modes and add native Terraform tests for defaults, direct credentials, standalone endpoints, AI Gateway, validations, and pipeline output ordering.

Generated by Coder Agents.

[DevelopmentCats]

Thank you for the contribution @ausbru87 If you could take a look at the failing CI and resolve I will review once its passing.

[github-actions]

Module Scorecard Check

coder-labs/pool: first scorecard, 100 / 100

No specific score is required to contribute, but modules with higher scores are more likely to be approved by the Coder team and widely used.

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	25 / 25	20 / 20	20 / 20	10 / 10	100 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples: basic install with API key, AI Gateway mode, OpenAI-compatible endpoint mode, air-gapped/mirrored mode, bring-your-own-binary mode. Each has sensible defaults and clear use cases.
Coder-context framing	8	8	Opening paragraph explicitly names both Coder and Pool, explains the module "wires Pool's authentication and endpoints to Coder so developers get a ready-to-use agent without pasting credentials by hand," and shows Coder's role in the flow.
Visual preview	5	5	README includes  and the image file exists (177.0 KB verified).

Agent Integration — 25 / 25

Criterion	Max	Score	Notes
AI governance	10	10	Both AI Gateway and Agent Firewall documented. AI Gateway section shows enable_ai_gateway = true with full explanation of centralized auth/routing. Agent Firewall section shows integration with the agent-firewall module and wrapper usage.
Dashboard entry point	5	5	coder_app example provided with slug, display_name, icon, open_in, and command launching Pool interactively.
Session continuity	5	5	Dedicated "Session continuity" section documents running Pool in a persistent tmux session with coder_script starting the session and coder_app attaching to it across reconnects.
Managed configuration	5	5	Module manages Pool configuration through environment variables (POOLSIDE_API_KEY, POOLSIDE_API_URL, POOLSIDE_STANDALONE_BASE_URL, POOLSIDE_STANDALONE_MODEL) via coder_env resources, documented in multiple sections including AI Gateway and OpenAI-compatible endpoints.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	poolside_api_key input marked sensitive = true in main.tf. README examples consistently use var.poolside_api_key and var.gateway_api_key rather than inline literals. NOTE block explicitly instructs: "Pass secrets such as poolside_api_key through a sensitive Terraform variable...rather than inline literals, so keys never land in template source or state diffs."
Non-hardcoded auth path	4	4	AI Gateway mode (enable_ai_gateway = true) documented as a path that avoids pasting raw keys: "developers never handle a provider key" because the module uses the workspace owner's session token automatically.

Restricted-Environment Readiness — 20 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	install_url variable (default https://downloads.poolside.ai/pool/install.sh) overrides the installer download URL. README documents: "Override to install from an internal mirror or artifact store in restricted or air-gapped environments" with example setting it to https://artifacts.internal.example.com/pool/install.sh.
Bring-your-own binary	5	5	install_pool = false documented under "Existing installations" section: "Set install_pool = false when Pool CLI is already present in your workspace image." Also mentions pool_binary_path for non-default locations.
Egress transparency	3	3	Dedicated "Network access and air-gapped environments" section with a table enumerating all external endpoints: install-time (https://downloads.poolside.ai/pool/install.sh + binaries), runtime (Poolside hosted API, Coder AI Gateway, standalone_base_url), with "When" and "How to override" columns. Includes guidance for restricted/air-gapped scenarios.
Runs without sudo	2	2	Install script (scripts/install.sh.tftpl) never invokes sudo. Uses curl, mkdir -p, ln -s, shell profile edits—all unprivileged operations. Installer exports POOL_INSTALL_* environment variables and pipes to sh without privilege escalation.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults: install_pool = true, pool_binary_path = "$HOME/.local/bin", install_url points to official source. Validation blocks enforce URL formats for install_url, poolside_api_url, standalone_base_url, and mutual exclusivity between enable_ai_gateway and conflicting options.
Test coverage	4	4	main.tftest.hcl includes 10 test runs covering defaults, URL overrides, invalid URL rejection, API key handling, standalone endpoint configuration, AI Gateway mode, mutual exclusivity validations, and scripts output. Tests cover business logic (validations, conditional resource creation).

Overall — 100 / 100

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.

[ausbru87]

@DevelopmentCats I pushed some updates to resolve the pipeline issues. please re-review.

[DevelopmentCats]

Other than my last change here everything looks good and I tested it from my end.

[bpmct]

Wowza. 100/100 on the scorecard!