JupyterLab module

[bpmct]

A discussion dedicated to the JupyterLab module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	25 / 25	20 / 20	0 / 20	8 / 10	76 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for default mode (loopback binding), external network access mode (0.0.0.0), and advanced configuration mode with custom config parameter. Each has sensible defaults and clear use cases.
Visual preview	5	5	README includes  and the image file exists at 428.3 KB.

IDE Integration — 25 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper URL construction for both subdomain and path modes, healthcheck, and configurable share/order/group parameters.
Managed configuration	6	6	Documented support for managed IDE settings via the config parameter, which writes ~/.jupyter/jupyter_server_config.json. README shows example with ServerApp settings and CSP configuration for iframe embedding.
Configurable folder or workdir	6	6	README example demonstrates root_dir = "/workspace/notebooks" in the config parameter, showing how to configure the working directory.
Pre-installed extensions	6	6	N/A - JupyterLab extensions are installed via pip/pipx/uv after the base installation, which is documented in the installation flow. The module supports this through the installer detection mechanism.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secrets are used in this module. JupyterLab is configured with --ServerApp.token='' and --ServerApp.password='' (empty authentication), relying on Coder's application proxy for auth. No sensitive inputs exist.
Non-hardcoded auth path	4	4	Authentication is handled entirely through Coder's application proxy. No API keys or credentials are required. The module explicitly disables JupyterLab's built-in auth to rely on Coder's OAuth/session management.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The module installs JupyterLab via pipx install jupyterlab or uv pip install jupyterlab with hardcoded package names. No variable exists to override the PyPI repository URL or provide an alternative package index.
Bring-your-own binary	10	0	The script checks if ! command -v jupyter-lab and installs if missing, but provides no documented way to skip installation when the tool is pre-baked. The check is a runtime optimization, not a configurable disable mechanism.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. PyPI access is implicit in the install commands but not documented. The external network access section discusses binding addresses, not egress endpoints.
Runs without sudo	2	0	The run.sh script uses pipx install and uv pip install which install to user directories ($HOME/.local/bin and $HOME/.venv/bin), and the config script writes to $HOME/.jupyter. No sudo invocations are present in any script. However, the test file shows apk add pipx and apk --no-cache add uv which would require root in Alpine. The module assumes installers are pre-installed per the error message, but the test setup reveals the practical requirement. Scoring 0 because the documented prerequisite (pre-installed pipx/uv) typically requires root to satisfy.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (127.0.0.1, port 19999, subdomain true). Validation exists for host (regex pattern) and share (enum check). The config parameter could benefit from validation but accepts any JSON string by design.
Test coverage	4	2	.tftest.hcl covers secure defaults, path mode, IPv6, and unsafe host rejection (business logic). TypeScript tests in main.test.ts cover installer detection, config file writing, and argument rendering. However, the two most important end-to-end tests (pipx and uv installation) are commented out with "TODO: Add faster test...currently times out." Only the failure case (no installer) and config writing are actually tested end-to-end.

Overall — 76 / 100

Raw 70 / 92 → round(70 / 92 × 100) = 76

---

Scored against SCORECARD.md on 2026-09-14 with claude-sonnet-4-5.