#2949 extension push: eval()/new Function() safety check is a substring match and blocks obj.eval( method calls in bundled libraries

What happens

swamp extension push --dry-run (and a real push) refuses an extension with:

Safety errors (push blocked):
  .../extensions/models/_lib/engine/studio_asset_app.ts: File contains eval() or new Function() which are not allowed.

The file has no call to the global eval and no new Function. It embeds a bundled browser page that includes the cel-js CEL interpreter (npm:@marcbachmann/cel-js@7.6.1). cel-js names its tree-walking evaluator method eval, so the minified bundle contains about 32 member calls of the form f.eval(m.receiver, y) and one class method definition eval(t,n){return t.evaluate(this,t,n)}.

Why

The check (in the binary, CLI 20261001.095719.0-sha.f20ce9f1) is a plain substring test:

if (content.includes("eval(") || content.includes("new Function(")) { errors.push(...) }

So any member call or method named eval blocks a push, along with identifiers ending in eval, such as retrieval( or interval(, and the text inside strings and comments. The same library imported through an npm: specifier passes, because the scanner reads only the extension's own source files, so the check blocks the safe case and lets the same code through when it's imported from npm.

Expected

Only flag real dynamic code execution: a call to the global eval (not preceded by . or an identifier character, and not a method definition), indirect forms such as (0, eval)(...) or globalThis.eval(...), and new Function( / Function( called as a constructor. A token-level check (or the TypeScript AST the bundler already has) would do it. Strings and comments should not count.

Reproduce

An extension model whose source contains any of:

const r = interpreter.eval(ast, ctx);
class Interp { eval(node) { return node; } }

then swamp extension push manifest.yaml --dry-run.

Impact

Blocks @swamp/stagecraft (swamp-club #2947, release target 2026-10-14). Its studio page runs the factory engine in the browser, including CEL gate evaluation, under a default-src 'self' CSP that already forbids eval, so the page shows the library works without dynamic code.