JupyterLab module

[bpmct]

A discussion dedicated to the JupyterLab module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	19 / 25	20 / 20	7 / 20	10 / 10	73 / 100

Drilldown

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6 (half)	README shows basic usage, an "External network access" example (host = "0.0.0.0"), and a config JSON example with root_dir. Misses path-mode (subdomain = false) and share examples despite these being tested variables, so coverage of major modes is partial.
Visual preview	5	5 (full)	 embedded and verified to exist.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16 (full)	Module has no credential/secret inputs; token/password are hardcoded empty in run.sh, and no inline secrets appear anywhere in README examples.
Non-hardcoded auth path	4	4 (full)	README explicitly documents that JupyterLab binds to 127.0.0.1 so "unauthenticated traffic must pass through Coder's application proxy," avoiding a hardcoded JupyterLab token/password in favor of Coder's own auth.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable overrides the pip/pipx/uv install source for JupyterLab; package comes from default PyPI index with no override input.
Bring-your-own binary	10	5 (half)	run.sh checks command -v jupyter-lab and skips install if already present, but this fallback is never documented in the README as a supported offline/pre-baked path.
Egress transparency	3	0	No dedicated network/egress/air-gapped README section listing contacted endpoints (PyPI, etc.).
Runs without sudo	2	2 (full)	run.sh and the config script never invoke sudo; pipx/uv installs run as the current user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6 (full)	All variables have descriptions and sensible defaults; host and share include validation blocks (regex and allowed-value checks).
Test coverage	4	4 (full)	.tftest.hcl covers host validation, script rendering, and URL/base_url logic; main.test.ts covers end-to-end container behavior (config writing, CSP fallback, loopback binding, injection rejection).

IDE Integration — 19 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7 (full)	coder_app "jupyterlab" defined with subdomain, share, order, group, and healthcheck; shown in main usage example.
Managed configuration	6	6 (full)	config variable documented with a full README example writing ~/.jupyter/jupyter_server_config.json, including CSP settings for iframe embedding.
Configurable folder or workdir	6	6 (full)	README's config example explicitly sets root_dir = "/workspace/notebooks" as a documented way to start JupyterLab in a configured folder.
Pre-installed extensions (web IDEs only)	6	0	No documentation or mechanism for pre-installing JupyterLab extensions.

Overall — 73 / 100

Raw 67 / 92 → round(67 / 92 × 100) = 73

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.