fix: use ExpressionEvaluator instead of new Function for conditional formatting, extract PREVIEW_ROW_COUNT constant

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

packages/plugin-grid/src/ImportWizard.tsx

@@ -34,6 +34,9 @@ export interface ImportResult {
 
 type WizardStep = 'upload' | 'mapping' | 'preview';
 
+/** Maximum number of rows to show in the preview step */
+const PREVIEW_ROW_COUNT = 10;
+
 /** CSV parser with quote handling */
 function parseCSV(text: string): string[][] {
   const rows: string[][] = [];
@@ -211,7 +214,7 @@ const StepPreview: React.FC<{
     Object.entries(mapping).map(([idx, fieldName]) => ({
       csvIdx: Number(idx), header: headers[Number(idx)], field: fields.find((f) => f.name === fieldName)!,
     })), [mapping, headers, fields]);
-  const previewRows = rows.slice(0, 10);
+  const previewRows = rows.slice(0, PREVIEW_ROW_COUNT);
 
   const rowValidations = useMemo(() => previewRows.map((row, rIdx) => {
     const errs: Record<number, string> = {};

packages/plugin-list/src/ListView.tsx

@@ -16,6 +16,7 @@ import { SchemaRenderer, useNavigationOverlay } from '@object-ui/react';
 import { useDensityMode } from '@object-ui/react';
 import type { ListViewSchema } from '@object-ui/types';
 import { usePullToRefresh } from '@object-ui/mobile';
+import { ExpressionEvaluator } from '@object-ui/core';
 
 export interface ListViewProps {
   schema: ListViewSchema;
@@ -80,13 +81,12 @@ export function evaluateConditionalFormatting(
   for (const rule of rules) {
     let match = false;
 
-    // Expression-based evaluation (L2 feature)
+    // Expression-based evaluation (L2 feature) using safe ExpressionEvaluator
     if (rule.expression) {
       try {
-        const expr = rule.expression.replace(/^\$\{/, '').replace(/\}$/, '');
-        // Build a safe evaluation context with data fields
-        const fn = new Function('data', `try { return !!(${expr}); } catch { return false; }`);
-        match = fn(record) === true;
+        const evaluator = new ExpressionEvaluator({ data: record });
+        const result = evaluator.evaluate(rule.expression, { throwOnError: true });
+        match = result === true;
       } catch {
         match = false;
       }