JupyterLab module

[bpmct]

A discussion dedicated to the JupyterLab module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	19 / 25	20 / 20	7 / 20	10 / 10	73 / 100

Drilldown

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README documents three modes: default (subdomain + loopback), external host (host = "0.0.0.0"), and custom config JSON. However, the path mode (subdomain = false)—a significant alternative access pattern—is not shown in any README example, and the share variable (owner/authenticated/public) has no example. Half credit for covering the primary modes but omitting a major one.
Visual preview	5	5	README embeds ; image verified to exist at 428.3 KB.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No dedicated secret inputs exist (no api_key, token, or password variables). The config variable is a general-purpose JSON blob, not a secret input. README examples contain no inline secrets or placeholder keys.
Non-hardcoded auth path	4	4	README explicitly states: "JupyterLab listens on 127.0.0.1 by default so that unauthenticated traffic must pass through Coder's application proxy." The script sets --ServerApp.token='' and --ServerApp.password='', delegating auth entirely to Coder's proxy.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh installs via pipx install jupyterlab or uv pip install -q jupyterlab with no variable to override the package index URL. No pip_index_url, uv_index, or equivalent input exists.
Bring-your-own binary	10	5	run.sh checks command -v jupyter-lab and skips installation if already present ("🥳 jupyterlab is already installed"). The behavior is implemented in code but not documented in the README—no section tells users they can pre-bake JupyterLab into their image.
Egress transparency	3	0	No dedicated section enumerating external endpoints (PyPI for pipx/uv, Coder API). The "External network access" section addresses host binding, not egress. No air-gapped or offline guidance.
Runs without sudo	2	2	Neither run.sh nor the config script invokes sudo. pipx/uv install to $HOME/.local/bin or $HOME/.venv/bin; config writes to $HOME/.jupyter. Fully unprivileged.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 9 variables have description fields. Sensible defaults throughout (host="127.0.0.1", port=19999, share="owner", subdomain=true). host has a regex validation rejecting shell metacharacters; share has an enum validation.
Test coverage	4	4	main.tftest.hcl covers secure defaults, path mode, IPv6, and unsafe-host rejection (business logic). main.test.ts runs the script in containers verifying installer detection, config file writing, CSP fallback, loopback binding, and host injection rejection (end-to-end). Two install-path tests are commented out (timeout), but the shipped tests cover the critical logic paths.

IDE Integration — 19 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper url, subdomain, share, order, group, and a healthcheck block (/api endpoint, 5 s interval, 6 threshold).
Managed configuration	6	6	config variable (JSON string) writes ~/.jupyter/jupyter_server_config.json via a dedicated coder_script. README documents the parameter with a full ServerApp example.
Configurable folder or workdir	6	6	README configuration example explicitly shows root_dir = "/workspace/notebooks" under ServerApp, documenting how to set the working directory.
Pre-installed extensions	6	0	No variable, script, or README section supports pre-installing JupyterLab extensions (e.g., jupyter lab extension install). Absent.

Overall — 73 / 100

Raw 67 / 92 → round(67 / 92 × 100) = 73

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.