kingpanther13
diff --git a/‎AGENTS.md‎
Lines changed: 19 additions & 8 deletions b/‎AGENTS.md‎
Lines changed: 19 additions & 8 deletions
diff --git a/‎tests/js/extract_astro_vars.mjs‎
Lines changed: 40 additions & 23 deletions b/‎tests/js/extract_astro_vars.mjs‎
Lines changed: 40 additions & 23 deletions
@@ -570,11 +570,14 @@ assert result.reloads == 1
 assert result.broadcasts_of_type("restart-required")
 ```
 
-The harness fakes time (`setTimeout` / `Date.now` on a virtual clock —
-60s probe windows take milliseconds), stubs `fetch` from a URL pattern
-map, captures `location.reload` via JSDOM's `jsdomError` channel
-(unforgeable IDL property), and provides a `BroadcastChannel` shim that
-can be primed with cross-tab events.
+The harness fakes `setTimeout` / `setInterval` / `Date.now` on a
+virtual clock (a 60 s production probe completes in milliseconds of
+wall time), stubs `fetch` from a URL pattern map (with optional
+`responses: [...]` sequencing for state-flip flows), captures
+`location.reload` via JSDOM's `jsdomError` channel (unforgeable IDL
+property), and provides a `BroadcastChannel` shim that can be primed
+with cross-tab events. `new Date()` / `performance.now()` continue to
+report wall time — only the three sources above are faked.
 
 Astro `<script>` blocks without `define:vars` / `is:inline` are
 TypeScript by default — pass `language="ts"` to `run_script` and the
@@ -592,9 +595,17 @@ result = run_script(script, prelude=prelude, ...)
 CI installs Node + jsdom in the `unit-tests` job (`.github/workflows/pr.yml`).
 Local devs without `tests/js/node_modules/` get clean skips.
 
-When adding a new UI surface: drop the file, add behavioural tests in
-`tests/src/unit/test_*_js_behavior.py` mirroring the existing per-
-surface modules; parse coverage is automatic.
+When adding a new UI surface:
+- Python-rendered HTML: register the renderer in
+  `_js_harness.py::_PY_RENDERERS` so the auto-discovery walker picks
+  it up for parse coverage.
+- Astro page: drop the `.astro` file under `site/src/`; discovery walks
+  the tree automatically.
+- Behavioural tests: add a `test_<surface>_js_behavior.py` module
+  alongside the existing ones (`test_settings_ui_js_behavior.py`,
+  `test_astro_setup_js_behavior.py`, `test_astro_tools_js_behavior.py`,
+  `test_astro_layout_js_behavior.py`, `test_consent_form_js_behavior.py`)
+  — pattern is one module per UI surface.
 
 ## Setup Wizard (`site/src/pages/setup.astro`)
 
 
@@ -14,6 +14,7 @@
 // Outputs: {"clientsData": [...], "platformsData": [...]}
 
 import { readFileSync } from "node:fs";
+import { createContext, runInContext } from "node:vm";
 import { transformSync } from "esbuild";
 
 function readStdin() {
@@ -34,24 +35,29 @@ function extractFrontmatter(source) {
   return m[1];
 }
 
+function stripImports(fm) {
+  // Drop both single-line (`import X from 'y';`) and multi-line
+  // (`import {\n  a,\n  b,\n} from 'y';`) import statements. The
+  // grammar matches `import` at line start optionally followed by
+  // anything up to the first semicolon, including newlines. Doesn't
+  // need to be a perfect TS parser — Astro frontmatter imports always
+  // sit at the top before any other statements.
+  return fm.replace(/^[ \t]*import\b[\s\S]*?;[ \t]*\n?/gm, "");
+}
+
 function sanitiseFrontmatter(fm) {
-  // Drop imports (would fail to resolve in this context) and lines that
-  // reach into `import.meta` (Astro-only). Leave const / let / function
-  // declarations intact so consts the test asks for are still in scope.
-  //
-  // Then prepend stubs for the most common Astro-injected globals so
-  // helper functions in the frontmatter (e.g. `withBase` referencing
-  // `base = import.meta.env.BASE_URL`) don't ReferenceError when re-
-  // evaluated outside Astro.
+  // Drop imports (would fail to resolve in this context) and lines
+  // that reach into `import.meta` (Astro-only). Then prepend stubs for
+  // the most common Astro-injected globals so frontmatter helpers
+  // (e.g. `withBase` referencing `base = import.meta.env.BASE_URL`)
+  // don't ReferenceError when re-evaluated outside Astro.
   const stubs = `const base = "";\n`;
-  return (
-    stubs +
-    fm
-      .split("\n")
-      .filter((line) => !/^\s*import\b/.test(line))
-      .filter((line) => !/\bimport\.meta\b/.test(line))
-      .join("\n")
-  );
+  const noImports = stripImports(fm);
+  const noImportMeta = noImports
+    .split("\n")
+    .filter((line) => !/\bimport\.meta\b/.test(line))
+    .join("\n");
+  return stubs + noImportMeta;
 }
 
 async function main() {
@@ -61,21 +67,32 @@ async function main() {
   const cleaned = sanitiseFrontmatter(extractFrontmatter(src));
 
   // Append a JSON serialiser for each requested name so we get a single
-  // structured payload back. ``stringify`` runs after every const in
-  // ``cleaned`` is in scope.
+  // structured payload back. `stringify` runs after every const in
+  // `cleaned` is in scope.
   const names = req.names || [];
-  const payload = names.map((n) => `"${n}": typeof ${n} !== 'undefined' ? ${n} : null`);
-  const program = `${cleaned}\n;process.stdout.write(JSON.stringify({${payload.join(",")}}));`;
+  const payload = names.map(
+    (n) => `"${n}": typeof ${n} !== 'undefined' ? ${n} : null`,
+  );
+  const program = `${cleaned}\n;__result = JSON.stringify({${payload.join(",")}});`;
 
   const transpiled = transformSync(program, {
     loader: "ts",
     target: "es2020",
     format: "esm",
   }).code;
 
-  // Evaluate in this same module — esbuild output is plain JS now.
-  // Using indirect eval keeps the top-level scope clean.
-  (0, eval)(transpiled);
+  // vm.runInContext rather than eval so the project's "no eval()" lint
+  // stays clean. New context per invocation (no globals from the host)
+  // — `__result` is the only handoff back.
+  const ctx = createContext({ __result: null });
+  try {
+    runInContext(transpiled, ctx, { filename: `astro-vars:${req.path}` });
+  } catch (e) {
+    throw new Error(
+      `evaluating frontmatter of ${req.path}: ${(e && e.stack) || e}`,
+    );
+  }
+  process.stdout.write(ctx.__result ?? "{}");
 }
 
 main().catch((e) => {