JupyterLab module

[bpmct]

A discussion dedicated to the JupyterLab module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	25 / 25	20 / 20	0 / 20	8 / 10	76 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for default mode (loopback binding), external network access mode (0.0.0.0 binding with warning), and advanced configuration mode (custom config parameter). Each has sensible defaults and clear use cases.
Visual preview	5	5	README includes  which references an existing image file verified at 428.3 KB.

IDE Integration — 25 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper URL construction for both subdomain and path modes, healthcheck configured, and documented in README examples.
Managed configuration	6	6	Documented support for managed JupyterLab server settings via the config parameter, with README example showing how to configure ServerApp settings including root_dir. Config is written to ~/.jupyter/jupyter_server_config.json via coder_script.jupyterlab_config.
Configurable folder or workdir	6	6	README example explicitly demonstrates configuring root_dir = "/workspace/notebooks" via the config parameter to control the starting directory.
Pre-installed extensions	6	6	N/A - JupyterLab is a web IDE, but extension installation is handled through JupyterLab's own mechanisms (pip install) rather than being a module concern. The module provides the config mechanism that would enable pre-configuration. Scoring full credit as the config system supports this.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The module configures JupyterLab with --ServerApp.token='' and --ServerApp.password='' (explicitly disabled authentication, relying on Coder's proxy). No API keys or secrets are required or shown in examples.
Non-hardcoded auth path	4	4	Authentication is handled entirely through Coder's application proxy. JupyterLab runs without its own authentication (token='', password='') and binds to loopback by default, forcing all traffic through Coder's authenticated proxy. No raw keys needed.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The module installs JupyterLab via pipx install jupyterlab or uv pip install jupyterlab with hardcoded package names. No variable exists to override the PyPI source URL or point to an internal mirror.
Bring-your-own binary	10	0	The script checks if ! command -v jupyter-lab and installs if missing, but provides no documented way to skip installation when JupyterLab is pre-installed. The script will always attempt to locate or install jupyter-lab. No skip_install or similar variable exists.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. PyPI access for package installation is implicit in the code but not documented. The external network access section discusses binding behavior, not egress endpoints.
Runs without sudo	2	0	The install script (run.sh) uses pipx install or uv pip install which install to user directories ($HOME/.local/bin or $HOME/.venv/bin), and the config script writes to $HOME/.jupyter. No sudo invocations are present in the scripts. However, the test file shows apk add pipx and apk --no-cache add uv which would require root in Alpine. The module assumes pipx/uv are pre-installed (per the error message), but the tests demonstrate that package manager access is needed to set up the environment, implying sudo may be needed for initial setup. Scoring 0 as the prerequisite installation path requires elevated privileges.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (host=127.0.0.1, port=19999, subdomain=true). Validation present on host (regex pattern) and share (enum check). The config parameter could benefit from validation but is complex JSON so acceptable.
Test coverage	4	2	.tftest.hcl covers secure defaults, path mode, IPv6, and unsafe host rejection (business logic). TypeScript tests in main.test.ts cover installer detection, config file writing, and binding behavior. However, the TypeScript tests note that actual installation tests with pipx/uv are commented out due to timeouts, limiting end-to-end coverage. Half credit for incomplete e2e testing.

Overall — 76 / 100

Raw 70 / 92 → round(70 / 92 × 100) = 76

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.