I do have some spare time over the holiday and I can take a shot at hacking together a node.js equivalent of the Lua extension. Is that really the highest priority though? I'm willing to do it, but it seems like there are also a lot of other questions to be answered besides just the languagechoice.
A few thougths on one of these questions, namely sandboxing and time limits:
Google Caja (http://code.google.com/p/google-caja/) promises to provide control about accessible objects and parts of the DOM for JavaScript. This still does not solve the issue of run time limits. WebWorkers could be employed for something like this, but have a very high overhead for short script snippets.
In general, I believe that run time limits are harder to enforce for heavily jitted runtimes. In these, context switching is often coupled to memory allocation, so a tight jitted loop without memory allocations would need to be aborted using heavier process control mechanisms. Simple interpreters (as CPython) can use bytecode op counters for this purpose. While lower in process control overhead, this solution then suffers from bytecodes with different runtime characteristics. Memory-allocating bytecodes are especially problematic in this regard.
Gabriel