docs: address interactive docs review feedback

Author: danielgtaylor

site/layouts/_partials/hooks/body-end.html

@@ -4,6 +4,9 @@
 <script src='{{ "js/restish-playground.js" | relURL }}?v={{ $playgroundVersion }}'></script>
 {{ range .Params.extra_js -}}
   {{ $scriptPath := . }}
+  {{ if or (not (strings.HasPrefix $scriptPath "js/")) (strings.Contains $scriptPath "..") -}}
+    {{ errorf "extra_js path %q must be relative to site/static/js/ and must not contain parent traversal" $scriptPath }}
+  {{ end -}}
   {{ $scriptVersion := readFile (printf "static/%s" $scriptPath) | md5 }}
   <script src='{{ $scriptPath | relURL }}?v={{ $scriptVersion }}'></script>
 {{ end -}}

site/scripts/test-restish-playground.mjs

@@ -109,6 +109,14 @@ assert.deepEqual(
   "output format value completion"
 );
 
+const printCompletion = complete("restish api.rest.sh/images --rsh-print H");
+assert.ok(printCompletion.matches.includes("HBhbp"), "print transcript completion should include HBhbp");
+assert.equal(
+  printCompletion.matches.includes("Hhbp"),
+  false,
+  "print transcript completion should not include the invalid Hhbp spec"
+);
+
 assert.deepEqual(
   complete("restish api.rest.sh/im"),
   {
@@ -120,6 +128,17 @@ assert.deepEqual(
   "URL-ish docs path completion"
 );
 
+assert.equal(
+  api.shouldApplyCompletionKey({ key: "Tab", shiftKey: false }),
+  true,
+  "plain Tab should apply completions"
+);
+assert.equal(
+  api.shouldApplyCompletionKey({ key: "Tab", shiftKey: true }),
+  false,
+  "Shift+Tab should keep the browser focus traversal behavior"
+);
+
 const toonPlan = api.parseCommand("restish get https://api.rest.sh/items -o toon");
 assert.equal(toonPlan.flags.outputFormat, "toon");
 assert.equal(

site/static/js/restish-playground.js

@@ -156,7 +156,7 @@
   const cacheCompletions = ["clear", "dir", "list"];
   const pluginCompletions = ["debug", "install", "list", "remove"];
   const contentTypeCompletions = ["json", "form"];
-  const printCompletions = ["hbp", "hbpc", "h", "b", "Hhbp"];
+  const printCompletions = ["hbp", "hbpc", "h", "b", "HBhbp"];
   const filterLangCompletions = ["restish", "jq"];
   const imageFormatCompletions = ["jpeg", "png", "webp", "gif", "heic"];
   const documentFormatCompletions = ["json", "yaml", "xml", "html", "text", "csv"];
@@ -437,6 +437,10 @@
     return null;
   }
 
+  function shouldApplyCompletionKey(event) {
+    return event.key === "Tab" && !event.shiftKey;
+  }
+
   function flagCompletions(completedWords) {
     const flags = Array.from(valueFlags.keys())
       .concat(Array.from(boolFlags.keys()))
@@ -3187,7 +3191,7 @@
     }
 
     command.addEventListener("keydown", function (event) {
-      if (event.key === "Tab") {
+      if (shouldApplyCompletionKey(event)) {
         event.preventDefault();
         applyCompletion();
         resetCommandScroll();
@@ -3233,6 +3237,7 @@
       encodeTOONDocument,
       parseCommand,
       render,
+      shouldApplyCompletionKey,
       toonOutput
     };
   }