JupyterLab module

[bpmct]

A discussion dedicated to the JupyterLab module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
22 / 25	18 / 25	20 / 20	0 / 20	8 / 10	68 / 100

Drilldown

Presentation & Onboarding — 22 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default mode (loopback), external network access mode (0.0.0.0), and advanced configuration mode with custom config JSON. Each has sensible defaults and clear use cases.
Coder-context framing	8	8	README clearly states "A module that adds JupyterLab in your Coder template" and explains that JupyterLab listens on 127.0.0.1 by default so unauthenticated traffic must pass through Coder's application proxy. Shows where Coder fits in the security flow.
Visual preview	5	2.5	README references an image at ../../.images/jupyterlab.png but the actual image file is not provided in the module files. The icon reference exists but icons don't count per rubric.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource is present with proper URL construction for both subdomain and path modes, healthcheck, and configurable share/order/group parameters.
Managed configuration	6	6	Documented support for managed IDE settings via the config variable that writes ~/.jupyter/jupyter_server_config.json. README shows example with ServerApp configuration including root_dir and CSP settings.
Configurable folder or workdir	6	5	README example shows root_dir = "/workspace/notebooks" in the config parameter, demonstrating workdir configuration. However, this is shown only within the advanced config example rather than as a standalone documented feature, making it slightly under-documented.
Pre-installed extensions	6	0	No documentation or support for pre-installing JupyterLab extensions.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are present in the module. The module does not handle API keys, tokens, or passwords as inputs. JupyterLab is configured with empty token and password in the startup script.
Non-hardcoded auth path	4	4	Module relies on Coder's application proxy for authentication rather than requiring users to paste keys. No credential inputs needed.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The module installs JupyterLab via pipx or uv from default PyPI sources. There is no module input variable to override the package source URL. The installation commands pipx install jupyterlab and uv pip install jupyterlab use hardcoded package names with no URL override mechanism.
Bring-your-own binary	5	0	No documented way to skip installation when JupyterLab is pre-installed. The script checks if ! command -v jupyter-lab and installs if missing, but there's no variable to disable this behavior or documentation for pre-baked scenarios.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. While PyPI access is implicit from the install commands, there is no documentation of network requirements for restricted environments.
Runs without sudo	2	0	The run.sh script installs to user directories ($HOME/.local/bin for pipx, $HOME/.venv/bin for uv) and never invokes sudo. However, the test file shows apk add pipx and apk --no-cache add uv which require root. The module assumes pipx or uv are pre-installed per the error message, but the tests demonstrate that package manager access is needed, creating ambiguity about the actual deployment path.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults (host="127.0.0.1", port=19999, subdomain=true). Validation present for host (regex pattern) and share (enum check). The config variable could benefit from validation but JSON structure is documented.
Test coverage	4	2	.tftest.hcl covers secure defaults, path mode, IPv6, and unsafe host rejection. TypeScript tests in main.test.ts cover installer detection, config file writing, and host binding. However, the TypeScript tests for actual installation with pipx/uv are commented out as timing out, leaving end-to-end installation untested.

Overall — 68 / 100

---

Scored against SCORECARD.md on 2026-08-12 with claude-sonnet-4-5.