Took me a while to realize that I can't execute JS blocks. Kind of unexpected that go works and js doesn't in JS a web app :)
Executing JavaScript safely is actually hard. You don't want to just execute code in browser context because then an attacker could trick you to execute his JavaScript code and e.g. grab all your notes.
So you need to sandbox it via e.g. iframe or by running using wasm-compiled quickjs
Which is something I might do.
Additionally I'm thinking about allowing to run a javascript function over content of a block so e.g. you could base64-encode a text block etc.
By convention, if a note has html block and javascript block (and optionally css block), I could consider that a small website with index.html, index.js and index.css files and provide a preview of html output.