Lesson 1 · beginner

What a script is, and where it runs

The sandbox, and an honest list of what a script cannot do.

An NCR script is a small program you write that reads the bars on your chart, works something out from them, and draws the answer back onto the chart. That is the whole idea. Every indicator in the app started life as the same shape of calculation; a script lets you write one the app does not have.

It runs INSIDE YOUR BROWSER, on your machine, and never on a server. Nothing you write is sent anywhere unless you deliberately save or publish it. When you press Run, the app starts a small JavaScript engine in a background thread and hands your code to it along with a copy of the bars currently on screen.

Why a background thread matters to you

The engine runs on a worker thread, separate from the page. That is why an endless loop in your script freezes nothing: the app can stop the worker at any moment, and it does so automatically when a script overruns its time budget. You will never have to reload the tab because of something you wrote.

The engine is deliberately empty. It is not a browser tab and it is not the app. It has no page, no window, no address bar and no connection to anything. The only thing placed inside it is one object called ncr, and everything a script can do it does through that object.

What a script CANNOT do — the honest list

It cannot make a network request of any kind: there is no fetch, no XMLHttpRequest, no WebSocket and no import from a URL. It cannot read or write localStorage, cookies, IndexedDB or files. It cannot see your account, your email, your portfolio, your holdings or your session. It cannot place an order — there is no order function to call. It cannot touch the page: no DOM, no document, no window. And it cannot see another running script.

Two consequences follow, and both are worth internalising early. First, a script someone else wrote cannot steal anything from you, which is why installing one is safe in a way that running a downloaded program never is. Second, a script cannot reach data you could not already see yourself — every figure it reads comes back through the same request, with the same login, that the app itself uses.

The sandbox protects your ACCOUNT, not your ANALYSIS

This is the distinction to hold on to. Nothing a script does can harm your data or your money. But a script can absolutely compute the wrong number and draw it confidently on your chart — yours or someone else’s. Read the code before you trust the line.

Here is a complete script. It is not useful, but it is real: paste it in, press Run, and the message appears in the debug panel underneath the editor.

Your first script

Three lines. Everything after this lesson is a variation on them.

// Every script starts by saying what it is. This one is a study
// (an indicator) rather than a strategy.
ncr.study({ name: 'Hello', overlay: true });
 
// main() is where the work happens. The app calls it once, for you.
export function main() {
  // ncr.log writes to the debug panel under the editor.
  ncr.log('Hello from ' + ncr.chart.symbol() + ' on the ' + ncr.chart.timeframe() + ' timeframe');
  ncr.log('There are ' + ncr.data.length() + ' bars loaded right now.');
}

If you saw two lines appear in the debug panel, you have written and run a program. The rest of this track is about what to put between those braces.