feat: preview

backend/uframe/codegen.py

@@ -12,16 +12,13 @@ state) and generates a self-contained Python script that:
 
 from __future__ import annotations
 
-import textwrap
-from pathlib import Path
-
 from uframe.ir import (
-    IRNode, Page, Box, Row, Col, Spacer, Pad,
-    Heading, Text, Label, Divider, Link, ListNode, ListItem,
-    Gauge, Sparkline, Status, Table,
-    Form, Field, Password, Radio, Checkbox, FormButton,
+    IRNode, Page, Box, Spacer,
+    Heading, Text, Label, Divider, Link,
+    Gauge, Status,
+    Form, Field, FormButton,
     Let, Source, IfBlock, ForLoop, CacheControl, OnSubmit, StateDecl,
-    SourceType, BorderWeight, HeadingLevel, DividerStyle, ListStyle,
+    SourceType,
 )
 
 
@@ -70,11 +67,14 @@ def _emit_node(node: IRNode, indent_level: int = 0) -> list[str]:
         elif node.source_type == SourceType.JSON:
             lines.append(f"{ind}{var} = _read_json({node.command!r})")
         elif node.source_type == SourceType.PYTHON:
-            lines.append(f"{ind}{var} = eval({node.command!r})")
+            # Restricted eval — only datetime/secrets modules available
+            lines.append(f"{ind}{var} = eval({node.command!r}, {{'datetime': datetime, 'secrets': secrets}})")
         elif node.source_type == SourceType.PARAM:
             lines.append(f"{ind}{var} = _get_param({node.command!r})")
         elif node.source_type == SourceType.RNS:
-            lines.append(f"{ind}{var} = _shell('rnstatus {node.command}', timeout={node.timeout})")
+            import shlex as _shlex
+            safe_cmd = _shlex.quote(node.command)
+            lines.append(f"{ind}{var} = _shell('rnstatus ' + shlex.quote({safe_cmd!r}), timeout={node.timeout})")
 
     elif isinstance(node, CacheControl):
         lines.append(f"{ind}_cache_seconds = {node.seconds}")