Guard eval in Dashboard test harness; fix rollup build-mode warning suppression - #762

Summary

Two small, unrelated fixes discovered while investigating a build warning:

1. jgclark.Dashboard/src/clickHandlers.js — document + guard eval usage

doEvaluateString backs the Dashboard's internal React test suite (src/react/components/testing/*.tests.js), which needs to call arbitrary NotePlan API methods (e.g. Editor.openNoteByFilename(...)) from the webview side to set up test fixtures. That's why it evals a string in the backend JSContext.

Reachability: the Dashboard webview only ever loads this plugin's own bundled local JS — no remote content, no note content is eval'd or rendered unescaped into the webview. So this can only be reached today by the plugin's own trusted test code, or by an attacker who has already achieved script execution inside the webview via some unrelated XSS bug — in which case it would let them escalate from webview-only JS to the privileged backend JSContext.

The UI entry point (Dashboard.jsx's showDebugPanel) was already gated behind _logLevel === 'DEV' + FFlag_DebugPanel, but that only hid the button — the bridge handler itself (pluginToHTMLBridge.js's case 'evaluateString') had no runtime check, so anything able to construct a bridge message could reach eval() regardless of dev mode. Added a matching guard directly inside doEvaluateString, plus a detailed comment explaining why eval is used and what the actual risk surface is, so the protection isn't just a warning comment.

2. scripts/rollup.js — fix build-mode warning suppression

The build-mode path (-b/-nc, used by npc plugin:dev <id> -nc and CI) manually reconstructs inputOptions from getConfig(), picking only external/input/plugins/context/cache — silently dropping the onwarn handler that suppresses EVAL and MODULE_LEVEL_DIRECTIVE warnings. Watch mode spreads the entire config object, so it was never affected. This is what caused the "Use of eval... strongly discouraged" warning to keep appearing during -nc builds even though onwarn was written specifically to suppress it back in Dec 2024. Added the missing onwarn: options.onwarn to the build-mode inputOptions so both paths behave consistently.

Verification

• Full test suite passes: 198 suites, 4553 tests
• Flow error count on clickHandlers.js unchanged (16, confirmed via git stash comparison — the guard doesn't introduce new type errors)
• jgclark.Dashboard builds clean via npc plugin:dev jgclark.Dashboard -nc with no eval warning (previously present every build)
• eslint on both changed files: clean

🤖 Generated with Claude Code