Nodebook runs user code in a persistent Node.js child process per open notebook.
On startup the server reports the host Node version and process.execPath via GET /api/kernel/info. The UI shows kernel status: starting, idle, busy, or dead.
- Opening/running a notebook calls
POST /api/kernel/startwith anotebookId(usually the file path). - The manager spawns
node server/src/kernel/runner.jswithcwdset to the workspace root. - Cells are executed over stdin/stdout as newline-delimited JSON.
- Restart Kernel kills the child and starts a fresh one (clears in-memory bindings; does not clear saved notebook outputs).
- Execution timeout defaults to 30s (
NODEBOOK_CELL_TIMEOUT_MS).
require()of packages installed in the workspacenode_modules- Node built-ins (
fs,path, etc.) with workspace ascwd - Top-level
await - Cross-cell state via
var/ bare assignment on the shared VM context (const/letare script-local when a cell usesawait)
Nodebook prioritizes process isolation over a hard sandbox:
- One child process per notebook - a crash does not take down the server
- Filesystem API paths are confined to the workspace root (no
..escapes) - No helper that runs arbitrary shell commands
- Timeouts kill hung cells
This is a local developer tool. It does not claim to safely execute untrusted code. Treat notebooks like scripts you would run with node in that folder.
| Variable | Meaning |
|---|---|
NODEBOOK_ROOT |
Workspace directory (default: ./workspace) |
NODEBOOK_PORT |
HTTP port (default: 8787) |
NODEBOOK_HOST |
Bind address (default: 127.0.0.1) |
NODEBOOK_CELL_TIMEOUT_MS |
Per-cell timeout |