Jupyter Notebook module

[bpmct]

A discussion dedicated to the Jupyter Notebook module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	7 / 25	20 / 20	7 / 20	10 / 10	60 / 100

Drilldown

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows only two examples: default (loopback) and explicit host = "0.0.0.0". The module exposes share (owner/authenticated/public), requirements_path, pip_install_extra_packages, port, order, and group, but none of these have a documented example with sensible defaults. Half credit for covering the two most critical modes (default vs. external bind).
Visual preview	5	5	README embeds ; file verified to exist at 414 KB.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module (no API keys, tokens, or passwords as variables). The Jupyter token/password are hardcoded to empty strings in run.sh, relying on Coder's proxy for auth. README examples contain no inline secrets. Criterion is vacuously satisfied.
Non-hardcoded auth path	4	4	README explicitly states: "Jupyter Notebook listens on 127.0.0.1 by default so that unauthenticated traffic must pass through Coder's application proxy." The share variable (owner/authenticated/public) provides a documented, non-hardcoded auth path via Coder's proxy.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh installs via pipx install -q notebook with no variable to override the PyPI index URL or pip source. No pip_index_url, pipx_index_url, or equivalent input exists.
Bring-your-own binary	10	5	run.sh checks if ! command -v jupyter-notebook and skips installation if the binary is already present. However, the README does not document this pre-install path (no section saying "if jupyter-notebook is baked into your image, installation is skipped"). Implemented but under-documented → half.
Egress transparency	3	0	The "External network access" section in the README addresses host binding (0.0.0.0 vs. 127.0.0.1), not egress endpoints. No dedicated section enumerates pypi.org, pipx download URLs, or any other external domains contacted at install/runtime.
Runs without sudo	2	2	run.sh uses pipx (user-space install to $HOME/.local/bin) and never invokes sudo. All commands run as an unprivileged user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 9 variables have description fields (except share, which is compensated by its validation error message). Sensible defaults throughout. host has a regex validation rejecting shell metacharacters; share has an enum validation. port is typed number.
Test coverage	4	4	main.tftest.hcl covers business logic (secure defaults, host rendering, IPv6, injection rejection). main.test.ts covers end-to-end behavior including a container-based test that executes the actual run.sh script with a mock jupyter-notebook binary and verifies rendered arguments. Clear, layered testing story.

IDE Integration — 7 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with slug, display_name, url, icon, subdomain = true, share, order, and group. Proper launch behavior via Coder's application proxy.
Managed configuration	6	0	No support for managed Jupyter configuration files (jupyter_server_config.py, IPython profiles, kernel specs, .jupyter directory). The requirements_path and pip_install_extra_packages variables install Python packages, not IDE/server settings.
Configurable folder or workdir	6	0	No variable for --ServerApp.root_dir or equivalent. The script starts Jupyter with no working-directory flag. No documented way to open in a configured folder.
Pre-installed extensions	6	0	pip_install_extra_packages installs Python packages (documented example: numpy, pandas, matplotlib). This is not documented as Jupyter extension support (e.g., JupyterLab extensions, notebook extensions). No README section addresses pre-installing IDE extensions.

Overall — 60 / 100

Raw 55 / 92 → round(55 / 92 × 100) = 60

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.