al_marimo

marimo interactive Python notebooks for al-folio v1.x. Implements the plugin proposed in al-folio#3541.

gem "al_marimo", "= 1.0.0"

and in _config.yml — both lists, or the plugin is inert:

plugins:
  - al_marimo

Then opt in per page, in front matter:

---
layout: post
title: a notebook post
marimo: true
---

Nothing is loaded on pages without that flag, so bundling the plugin costs nothing site-wide.

{% al_marimo_embed src="https://marimo.app/l/abc123" height="700px" caption="Sampling demo" %}

Accepts src (required), height, width, mode (read / edit), embed, title, caption, class. src may be a literal or a Liquid variable.

Wrap fenced Python blocks in a container:

<div class="al-marimo-inline" markdown="1">

```python
import marimo as mo
mo.md("Hello from the browser")
```

</div>

The runtime moves those blocks into a <marimo-iframe> after load.

The source PR was explicitly a work in progress. Two things changed:

The runtime is vendored, not fetched from a CDN. The PR loaded https://cdn.jsdelivr.net/npm/@marimo-team/marimo-snippets@1 — an unpinned major version, with no integrity hash, executing in every visitor's page. That is the shape of the polyfill.io supply-chain attack. Pinning it with SRI is not possible either: that URL serves a dynamically minified build, and jsDelivr documents that such files must not be used with SRI because a minifier upgrade changes the bytes and would break every site at once. So the stable unminified source is vendored at an exact version, with its digest recorded in lib/vendor/provenance.json and a test that fails if the shipped file drifts from it.

Embedded notebooks do not get allow-same-origin. The PR's sandbox included it, which lets the embedded third-party notebook reach the embedding page's storage and cookies — defeating the purpose of the sandbox.

The notebook itself executes on marimo.app (or your own WASM host). Embedding one means your readers' browsers contact that origin. The vendored runtime also references a marimo-hosted icon. Nothing is sent unless a page opts in.

bundle install
bundle exec rake test
npm ci && npm run lint:prettier

MIT