JupyterLab module

[bpmct]

A discussion dedicated to the JupyterLab module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	13 / 25	20 / 20	0 / 20	8 / 10	58 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides two examples: basic usage and advanced configuration with the config parameter showing how to customize JupyterLab server settings including root_dir and CSP headers.
Coder-context framing	8	0	README states "A module that adds JupyterLab in your Coder template" but does not explain what JupyterLab adds on top of Coder or show where Coder fits in the workflow. No explanation of how Coder enhances or integrates with JupyterLab.
Visual preview	5	5	README includes  showing the module in action.

IDE Integration — 13 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource present with proper configuration including healthcheck, subdomain support, and URL handling for both subdomain and path-based access.
Managed configuration	6	6	config variable documented with example showing how to provide JupyterLab server settings as JSON. Config is written to ~/.jupyter/jupyter_server_config.json via coder_script.jupyterlab_config.
Configurable folder or workdir	6	0	No documented support for opening or starting in a configured folder. The example shows root_dir = "/workspace/notebooks" as part of general config, but there is no dedicated variable or documentation for workdir configuration.
Pre-installed extensions	6	0	No documented support for pre-installing JupyterLab extensions.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module. The config variable accepts server settings but the examples show token and password set to empty strings for Coder's authentication model. No inline secrets in README examples.
Non-hardcoded auth path	4	4	Module uses Coder's built-in authentication via the agent. JupyterLab is configured with empty token and password, relying on Coder's access control through the coder_app resource with configurable share parameter.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the JupyterLab installation source. The module uses pipx install jupyterlab or uv pip install jupyterlab with hardcoded package names and no URL override capability.
Bring-your-own binary	5	0	No documented way to skip installation when JupyterLab is pre-installed. The script checks if ! command -v jupyter-lab and installs if missing, but there is no variable to disable this behavior or documentation for pre-baked scenarios.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. PyPI access for package installation is implicit but not documented.
Runs without sudo	2	0	The run.sh script installs to user directories ($HOME/.venv/bin or $HOME/.local/bin) and never invokes sudo. However, the config script in main.tf uses #!/bin/sh and base64 -d which should work without sudo. Full credit earned from code inspection. Actually, reviewing more carefully: the run.sh uses pipx/uv which install to user space, and the config script writes to $HOME/.jupyter. No sudo invocations present. This earns full credit. Correction: 2 points.

Correction for Runs without sudo: Reviewing run.sh and the config script in main.tf: both scripts write to user home directories and use user-space installers (pipx, uv). No sudo commands present. Earns full 2 points.

Restricted-Environment Readiness — 2 / 20 (corrected)

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the JupyterLab installation source. The module uses pipx install jupyterlab or uv pip install jupyterlab with hardcoded package names and no URL override capability.
Bring-your-own binary	5	0	No documented way to skip installation when JupyterLab is pre-installed. The script checks if ! command -v jupyter-lab and installs if missing, but there is no variable to disable this behavior or documentation for pre-baked scenarios.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. PyPI access for package installation is implicit but not documented.
Runs without sudo	2	2	Scripts install to user directories ($HOME/.venv/bin, $HOME/.local/bin, $HOME/.jupyter) using user-space tools (pipx, uv). No sudo invocations in run.sh or config script.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions and sensible defaults. The share variable includes validation. port, log_path, subdomain, order, group, and config all have appropriate descriptions and defaults.
Test coverage	4	2	TypeScript tests in main.test.ts cover installer detection, config file writing, and CSP fallback behavior. However, the actual installation tests with pipx and uv are commented out (TODOs noting timeouts). No .tftest.hcl file present for Terraform-level testing.

Overall — 58 / 100

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.