cali-coding-go-stack

High-severity risk: this module contains multiple explicit client-side execution primitives. It compiles and executes dynamically generated code strings via Function(...), and it can directly execute server-returned JavaScript by injecting response text into a <script> element appended to document.head. It also patches server-supplied HTML into the live DOM and recreates script elements during reconciliation, making embedded scripts executable. Unless all server-driven expressions/HTML/JS are strictly trusted and integrity-protected, this design can enable full browser-context code execution, representing a significant supply-chain/runtime security risk.