Improve pkg/js

[dgageot]

There's still plenty things to improve but it's a first step.

Assisted-By: cagent

[docker-agent]

Review Summary

Assessment: 🟡 NEEDS ATTENTION

This PR refactors JavaScript expansion code with good improvements, but introduces 2 medium-severity issues that should be addressed:

1. API GET requests lack URL encoding: Template-substituted parameter values are not URL-encoded, which can corrupt query strings when values contain special characters
2. Error handling removed: Template expansion errors that were previously caught and propagated are now silently ignored, degrading observability

Both issues are in newly modified code paths and should be fixed before merge.

[docker-agent]

MEDIUM SEVERITY: Template expansion doesn't URL-encode parameter values

The t.expander.Expand(ctx, endpoint, params) call substitutes template variables into the endpoint URL without URL-encoding the values. If a parameter contains special characters like &, =, or ?, it will corrupt the URL query string.

Example: If endpoint is http://api.com/search?q=${query} and params["query"] is foo&bar=baz, the result becomes http://api.com/search?q=foo&bar=baz, which is parsed as two parameters (q=foo and bar=baz) instead of one.

Recommendation: URL-encode parameter values before expansion, or modify the Expand method to handle URL encoding for query string contexts.

[docker-agent]

MEDIUM SEVERITY: Template expansion error handling removed

The code was changed from ExpandString(ctx, b.prompt, values) which returned (string, error) to b.expander.Expand(ctx, b.prompt, values) which only returns string. The old code had error checking that would return fmt.Errorf("failed to expand prompt template: %w", err) on failures.

The new Expand method silently returns the original text on JS evaluation errors (see expand.go:138). This means:

• Template expansion errors are no longer detected
• Unexpanded template text will be used instead, leading to incorrect semantic summaries
• Observability and debugging are degraded

Recommendation: Either use a version of Expand that returns errors, or add validation to ensure expansion succeeded (e.g., check if template variables are still present in the output).